IBM MQ Operator: Heap buffer overflow in MQPUT and MQPUT1 processing
Summary
IBM MQ Operator, which deploys and manages IBM MQ queue managers on Kubernetes and OpenShift, contains a heap buffer overflow when processing MQPUT and MQPUT1 operations with malformed message handle properties. An authenticated attacker with valid MQ access can exploit this over the network to cause a denial of service or potentially execute arbitrary code. The CVSS base score is 8.8.
Affected
- IBM MQ Operator: 3.2.0 to 3.2.29; 3.3.0 to below 3.4.0; 3.4.1; 3.5.0; 3.5.1 to 3.5.3; 3.6.0 to 3.6.4; 3.7.0 to 3.7.2; 3.8.0; 3.8.1; 3.9.0; 3.9.1; 3.9.2 (default: unaffected)
- IBM MQ Advanced container images in several 9.3.x, 9.4.x and 10.0.x levels (see the IBM bulletin for the full list)
Fixed in
- IBM MQ Operator v4.1.0 with IBM MQ Advanced 10.0.1.0-r1
- IBM MQ Operator v4.0.5 with IBM MQ Advanced 10.0.0.5-r2
- IBM MQ Operator v3.2.30 with IBM MQ Advanced 9.4.0.26-r2
- IBM MQ Container 10.0.1.0-r1 and 10.0.0.5-r2
Fixed versions for other affected release lines: Unknown.
Workaround
Unknown. No vendor workaround is listed in the sources.
- Until the fix is applied, restrict MQPUT and MQPUT1 authority to trusted service accounts (general mitigation, not confirmed by IBM for this CVE).
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of active exploitation found; not listed in KEV.
- A public PoC listing exists, but its content is unverified.
Our recommendation
- Check whether IBM MQ Operator or IBM MQ Advanced container images are deployed, and at which version.
- Upgrade to a fixed version listed by IBM and verify the fix for your release line on the IBM bulletin.
- Until patched, restrict MQPUT and MQPUT1 access to trusted accounts and monitor MQ for unusual put activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin node/7292667 www.ibm.com
- OpenCVE CVE-2026-10574 app.opencve.io
- HOL Guard CVE-2026-10574 hol.org
- Strix CVE-2026-10574 www.strix.ai
- OffSeq Radar CVE-2026-10574 radar.offseq.com
- Sploitus CVE-2026-10574 (unverified PoC listing) sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:48.
Original description (NVD)
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.