{"id":"CVE-2026-10574","kind":"vulnerability","aliases":["CVE-2026-10574"],"related":[],"title":"IBM MQ Operator: malformed message handle properties overflow heap, allowing code execution","description":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.","summary":"Heap buffer overflow in IBM MQ (Operator and MQ Advanced container images) when processing MQPUT/MQPUT1 with malformed message handle properties. An authenticated network user can crash the queue manager or potentially execute code. CVSS 8.8. No known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":["4.0.5","4.1.0"],"affected":">= 4.0.0, <= 4.0.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.3.0, <= 3.9.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","openshift","self-hosted","vendor"],"not_affected_if":["managed-hosting","unaffected-version"],"how_to_check":"Find the installed operator version: 'oc get csv -n <ns> | grep ibm-mq' or 'kubectl get deploy -A -o wide | grep ibm-mq-operator'. Also check queue manager image tags (ibm-mqadvanced-server, e.g. 9.4.0.26-r1 or 10.0.0.5-r1 are affected). Affected operator: 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-3.9.2, 4.0.0-4.0.4.","fix":"Upgrade the IBM MQ Operator to 4.1.0 (CD, with MQ Advanced 10.0.1.0-r1), 4.0.5 (SC2, with 10.0.0.5-r2) or 3.2.30 (SC2, with 9.4.0.26-r2), and roll queue managers to the new image. IBM's fix for LTS 2.0.x is not stated in what I read: unknown.","status":"open","published_at":"2026-10-19T17:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:07+00:00","updated_at":"2026-10-24T00:21:40+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:33:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade IBM MQ Operator to a release above the affected ranges (2.0.x through 2.0.29, 3.2.x through 3.2.29, and 3.3.0 through 3.6.2); the fixed version is unknown from the sources.","reach":"network","title":"IBM MQ Operator: malformed message handle properties overflow heap, allowing code execution","impact":"high","summary":"IBM MQ Operator has a heap buffer overflow when handling MQPUT or MQPUT1 calls with malformed message handle properties. An authenticated attacker can crash the service or potentially run arbitrary code.","category":"vendor","who_cares":["ibm-mq","kubernetes","openshift"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker crashes the queue manager or potentially runs code on the host","analyst_note":"Find the fixed versions and check the IBM security bulletin for this CVE; the NVD entry lists no fixed-version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000531,"input_tokens":3230,"output_tokens":415,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed versions and check the IBM security bulletin for this CVE; the NVD entry lists no fixed-version data.","search":"'-10574':15A,18A '-2026':14A,17A '8.8':227B 'advanc':202B 'advanced':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'allow':10A,234C 'arbitrari':247C 'attack':237C 'authent':214B,236C 'buffer':194B,253C 'caus':239C 'code':11A,225B,248C 'contain':203B 'container':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'could':233C 'crash':218B 'cve':13A,16A 'cvss':226B 'denial':241C 'due':249C 'execut':12A,224B,246C 'exploit':230B 'handl':6A,211B,264C 'heap':9A,193B,252C 'host':191B 'ibm':1A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A,181A,185B,197B,231C 'ibm-mq':184B 'imag':204B 'images':105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A 'known':229B 'kubernet':187B 'malform':4A,209B,262C 'manag':221B 'messag':5A,210B,263C 'mq':2A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A,179A,182A,186B,198B,201B,232C 'mqput':257C 'mqput/mqput1':207B 'mqput1':259C 'network':215B 'openshift':188B 'oper':3A,199B,260C 'operator':21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,180A,183A 'overflow':8A,195B,254C 'potenti':223B,245C 'process':206B,256C 'properti':7A,212B,265C 'queue':220B 'self':190B 'self-host':189B 'servic':243C 'supplied':101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A 'user':216B 'vendor':192B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10574","severity":null,"published_at":"2026-10-19T17:17:01+00:00","modified_at":"2026-10-23T15:34:30+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10574:641","url":null,"severity":null,"published_at":"2026-10-24T00:21:40+00:00","modified_at":"2026-10-24T00:21:40+00:00","first_seen_at":"2026-10-24T00:21:40+00:00","fetched_at":"2026-10-24T00:21:40+00:00","note":"CVE.org (IBM CNA) gives affected list incl. 3.7-4.0.4; fixed versions 4.1.0 / 4.0.5 / 3.2.30 come from the IBM bulletin text as quoted by sploitus (IBM page itself not found, so secondary). No fix named for LTS 2.0.x or CD 3.3-3.9. No exploitation or PoC found (sploitus entry has no code). Skipped X search."}],"documents":[{"id":2564,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10574","title":"CVE Record CVE-2026-10574 (IBM CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2562,"url":"https://sploitus.com/cve/CVE-2026-10574","title":"Sploitus: CVE-2026-10574 (quotes IBM bulletin remediation)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1957,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31","title":"IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}