IBM MQ Operator: Buffer size validation flaw in MQOPEN
Summary
The IBM MQ Operator and the IBM-supplied MQ Advanced queue manager container images contain a flaw in the validation of buffer sizes in MQOPEN operations. An authenticated attacker with low privileges who can reach the MQ service over the network can cause a denial of service or corrupt memory. The official record maps the flaw to CWE-1223, which does not match the buffer-validation description, so the weakness type is not fully confirmed.
Affected
- IBM MQ Operator: 3.2.0 to 3.2.29; 3.3.0 to below 3.4.0; 3.4.1; 3.5.0; 3.5.1 to 3.5.3; 3.6.0 to 3.6.4; 3.7.0 to 3.7.2; 3.8.0; 3.8.1; 3.9.0; 3.9.1; 3.9.2 (default: unaffected)
- IBM MQ Advanced container images: multiple 9.3.x, 9.4.x and 10.0.x builds, see the IBM advisory for the exact list
Fixed in
- IBM MQ Operator v4.1.0 (CD release, MQ Advanced 10.0.1.0-r1)
- IBM MQ Operator v4.0.5 (SC2 release, MQ Advanced 10.0.0.5-r2)
- IBM MQ Operator v3.2.30 (SC2 release, MQ Advanced 9.4.0.26-r2)
- IBM MQ Container 10.0.1.0-r1 and 10.0.0.5-r2
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total
- No evidence of exploitation in the wild found in the sources
- No public proof of concept confirmed
Our recommendation
- Inventory all MQ Operator and MQ container deployments and their versions
- Patch to the fixed operator and container image versions listed above
- Confirm affected and fixed builds on the IBM advisory page before changing production systems
- Review which accounts can reach MQ and restrict MQOPEN access where possible
- Monitor MQ error logs for repeated failures
- Only Kubernetes or OpenShift deployments of MQ are relevant; standalone MQ falls under other bulletins
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7292667 www.ibm.com
- OpenCVE CVE-2026-10743 app.opencve.io
- HOL Guard CVE-2026-10743 hol.org
- PT-2026-117496 (Vulners) vulners.com
- ThreatInt CVE-2026-10743 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:47.
Original description (NVD)
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.