Live › vulnerability › CVE-2026-10572
Go to dashboardHeap buffer overflow in IBM MQ (queue manager) when processing MQPUT with malformed message options. An authenticated, network-reachable attacker with low privileges can cause DoS or potentially run code. CVSS 8.8 (IBM). Affects the MQ Operator and the IBM-supplied MQ Advanced container images. IBM lists no workarounds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ibm mq operator | vendor | >= 2.0.0, <= 2.0.29 | – |
| ibm mq operator | vendor | >= 3.2.0, <= 3.2.29 | – |
| ibm mq operator | vendor | = 3.3.0 | – |
| ibm mq operator | vendor | = 3.4.0 | – |
| ibm mq operator | vendor | = 3.4.1 | – |
| ibm mq operator | vendor | = 3.5.0 | – |
| ibm mq operator | vendor | = 3.5.1 | – |
| ibm mq operator | vendor | = 3.5.2 | – |
| ibm mq operator | vendor | = 3.5.3 | – |
| ibm mq operator | vendor | = 3.6.0 | – |
| ibm mq operator | vendor | = 3.6.1 | – |
| ibm mq operator | vendor | = 3.6.2 | – |
| ibm mq operator | vendor | = 3.6.3 | – |
| ibm mq operator | vendor | = 3.6.4 | – |
| ibm mq operator | vendor | = 3.7.0 | – |
| ibm mq operator | vendor | = 3.7.1 | – |
| ibm mq operator | vendor | = 3.7.2 | – |
| ibm mq operator | vendor | = 3.8.0 | – |
| ibm mq operator | vendor | = 3.8.1 | – |
| ibm mq operator | vendor | = 3.9.0 | – |
| ibm mq operator | vendor | = 3.9.1 | – |
| ibm mq operator | vendor | = 3.9.2 | – |
| ibm mq operator | vendor | = 4.0.0 | – |
| ibm mq operator | vendor | = 4.0.1 | – |
| ibm mq operator | vendor | = 4.0.2 | – |
| ibm mq operator | vendor | = 4.0.3 | – |
| ibm mq operator | vendor | = 4.0.4 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.1 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.0 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.5 | – |
| ibm supplied mq advanced container images | vendor | = 9.3.0.0 | – |
| ibm mq operator | vendor | >= 3.3.0, <= 4.0.4 | 4.0.5, 4.1.0 |
| ibm mq advanced container images | vendor | <= 10.0.0.5-r1 and 9.4.0.x through 9.4.0.26-r1 | 10.0.1.0-r1, 10.0.0.5-r2, 9.4.0.26-r2 |
kubectl get deployment -n <ns> and read the ibm-mq-operator image tag){.status.versions} or the pod image)2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0, 3.4.0-3.4.1, 3.5.0-3.5.3, 3.6.0-3.6.4, 3.7.0-3.7.2, 3.8.0-3.8.1, 3.9.0-3.9.2, 4.0.0-4.0.4, plus MQ Advanced images older than the fixed ones4.1.0 with MQ Advanced 10.0.1.0-r1 (CD); 4.0.5 with 10.0.0.5-r2 (SC2); 3.2.30 with 9.4.0.26-r2 (SC2)10.0.1.0-r1 or 10.0.0.5-r2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
This page as .md · .json · in your agent: get_signal("CVE-2026-10572")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.