IBM MQ Heap Buffer Overflow in MQPUT Allows Code Execution

IBM MQ contains a heap buffer overflow vulnerability that enables authenticated attackers to disrupt services or execute arbitrary code. The flaw resides in how the system processes MQPUT and MQPUT1 operations when message handle properties are malformed. According to the National Vulnerability Database, this issue is tracked as CVE-2026-10574. It affects a wide range of IBM MQ Advanced container images and operator versions. Environments using these components are exposed to this risk if they permit authenticated users to submit such operations.

Root cause

The underlying weakness is a heap buffer overflow, identified by the Common Weakness Enumeration as CWE-122. This occurs when the application writes data beyond the allocated memory space for the heap. In this specific case, the overflow happens during the handling of message properties associated with MQPUT or MQPUT1 requests. The NVD record describes the flaw as allowing an attacker to cause a denial of service or potentially execute arbitrary code. This indicates that memory corruption leads to unpredictable behavior, including service crashes or control flow hijacking.

Attack path

An attacker must first obtain authentication credentials for the IBM MQ system. Once authenticated, the threat actor sends MQPUT or MQPUT1 operations containing malformed message handle properties. The malformed data triggers the heap buffer overflow within the processing logic. As a result, the system may crash, leading to a denial of service condition. Alternatively, the attacker might exploit the memory corruption to execute arbitrary code on the host system. The potential for code execution depends on the specific environment and memory layout.

Affected versions

The vulnerability impacts multiple versions of IBM MQ software. Affected products include IBM MQ Operator up to version 3.2.29, as well as versions before 3.4.0, 3.4.1, and 3.5.0. Numerous IBM MQ Advanced container images are also affected, spanning CD, LTS, and standard release tracks. Specific affected versions include 9.3.0.0-r1 through 9.3.0.25-r1, 9.4.0.0-r1 through 9.4.0.26-r1, and 9.4.1.0-r1 through 9.4.5.1-r1. Version 10.0.0.0-r1 through 10.0.0.0-r4 and 10.0.0.5-r1 are also listed as vulnerable in the NVD record.

Mitigation

• Identify all instances of IBM MQ Operator and Advanced container images in your environment.
• Compare installed versions against the list of affected releases provided in the NVD record.
• Apply updates to move to versions that are not listed as vulnerable, if available.
• Restrict access to MQPUT and MQPUT1 operations to trusted, authenticated users only.
• Monitor logs for signs of malformed message handles or unexpected service crashes.

Signals worth monitoring

Teams usually review application logs for error messages related to malformed input or unexpected termination. Check whether MQPUT or MQPUT1 operations are failing with memory-related errors. Look for spikes in resource consumption or unhandled exceptions during message processing. Verify that authentication logs show legitimate access patterns, as the attack requires valid credentials. Isolate affected systems immediately if signs of exploitation appear. Ensure that incident response plans include procedures for handling memory corruption events. Monitor network traffic for unusual data payloads sent to MQ endpoints.

What to do and how to stay safe: IBM MQ

• Audit your inventory for any installations of IBM MQ Operator or Advanced container images.
• Verify the specific version numbers against the affected list in the CVE record.
• Implement strict authentication and authorization controls for MQPUT and MQPUT1 operations.
• Monitor system logs for anomalies such as crashes or memory errors during message handling.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-10574?

The vulnerability has a CVSS score of 8.8, which is classified as high severity.

Which IBM MQ components are affected?

IBM MQ Operator up to 3.2.29 and specific versions before 3.4.0, 3.4.1, and 3.5.0, along with many IBM MQ Advanced container images.

Is a patch available for this vulnerability?

The source material does not confirm the availability of a patch or fix for this issue.