IBM MQ Operator: Stack-based buffer overflow in TLS certificate processing
Summary
IBM MQ Operator and IBM-supplied MQ Advanced container images contain a stack-based buffer overflow (CWE-121) when processing TLS certificates with malformed distinguished names during channel connection establishment. A remote attacker can exploit this without authentication or user interaction to execute arbitrary code, which could lead to full compromise of the queue manager (CVSS 9.8 per NVD). The attack requires network access to an MQ channel listener.
Affected
- IBM MQ Operator: 3.2.0 to 3.2.29; 3.3.0 to below 3.4.0; 3.4.1; 3.5.0; 3.5.1 to 3.5.3; 3.6.0 to 3.6.4; 3.7.0 to 3.7.2; 3.8.0; 3.8.1; 3.9.0; 3.9.1; 3.9.2 (according to the CNA record; the default configuration is unaffected)
- IBM MQ Advanced container images in the 9.4.x, 9.3.x LTS and 10.0.x lines (multiple builds, see IBM bulletin)
- Versions of the MQ Operator 4.x and 2.x lines are listed in secondary databases only; verify against the IBM bulletin.
Fixed in
- MQ Operator v4.1.0 (CD release with MQ Advanced 10.0.1.0-r1)
- MQ Operator v4.0.5 (SC2 release with MQ Advanced 10.0.0.5-r2)
- MQ Operator v3.2.30 (SC2 release with MQ Advanced 9.4.0.26-r2)
- MQ Container 10.0.1.0-r1 and 10.0.0.5-r2
- Fixed versions for the 2.x and 3.3 to 3.9 branches: Unknown. Check the IBM bulletin.
Workaround
- Unknown from IBM's text. A secondary source suggests monitoring TLS connections to the queue manager for malformed distinguished names and blocking such connections at the perimeter or with firewall rules until patching.
Exploitation
- Not listed in CISA KEV. CISA SSVC: exploitation none, not automatable.
- EPSS below 1%.
- No verified public proof of concept found; one database entry contains no exploit content.
Our recommendation
- Inventory all MQ Operator and MQ container deployments, including versions and whether any MQ channel listener is reachable from outside.
- Check the IBM bulletin for the exact fixed build for each branch in use.
- Restrict access to MQ channel listeners to known networks until patched.
- Patch with priority, given the CVSS 9.8 rating and the unauthenticated network attack path.
- Review all MQ TLS certificate handling, as a related CWE-121 issue (CVE-2026-12150) exists.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (node 7292667) www.ibm.com
- HOL Guard: CVE-2026-12665 IBM MQ buffer overflow hol.org
- OpenCVE: CVE-2026-12665 app.opencve.io
- Strix: CVE-2026-12665 www.strix.ai
- VulDB: CVE-2026-12665 vuldb.com
- ThreatInt: CVE-2026-12665 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:24.
Original description (NVD)
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.