Buffer overflow in IBM Mq
CVE-2026-11728
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or through a man-in-the-middle attack.
Vulnerability class: Buffer Overflow
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Ibm Mq — versions 10.0.0.0
Weakness classification (CWE)
References
- psirt@us.ibm.com (vendor-advisory, patch)
Frequently asked questions
- What is CVE-2026-11728?
- CVE-2026-11728 is a high-severity vulnerability in IBM Mq, classified under Out-of-bounds Write. CVSS score: 8.1/10. Published 2026-09-15.
- How severe is CVE-2026-11728?
- High severity. CVSS v3 base score is 8.1 out of 10.