Live › vulnerability › CVE-2026-10743
Go to dashboardIBM MQ (Operator and MQ Advanced container images) does not properly validate buffer sizes in MQOPEN operations. An authenticated network user can crash the queue manager or corrupt its memory. CVSS 8.8. No exploitation reported. IBM lists no workaround.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ibm mq operator | vendor | >= 2.0.0, <= 2.0.29 | – |
| ibm mq operator | vendor | >= 3.2.0, <= 3.2.29 | – |
| ibm mq operator | vendor | = 3.3.0 | – |
| ibm mq operator | vendor | = 3.4.0 | – |
| ibm mq operator | vendor | = 3.4.1 | – |
| ibm mq operator | vendor | = 3.5.0 | – |
| ibm mq operator | vendor | = 3.5.1 | – |
| ibm mq operator | vendor | = 3.5.2 | – |
| ibm mq operator | vendor | = 3.5.3 | – |
| ibm mq operator | vendor | = 3.6.0 | – |
| ibm mq operator | vendor | = 3.6.1 | – |
| ibm mq operator | vendor | = 3.6.2 | – |
| ibm mq operator | vendor | = 3.6.3 | – |
| ibm mq operator | vendor | = 3.6.4 | – |
| ibm mq operator | vendor | = 3.7.0 | – |
| ibm mq operator | vendor | = 3.7.1 | – |
| ibm mq operator | vendor | = 3.7.2 | – |
| ibm mq operator | vendor | = 3.8.0 | – |
| ibm mq operator | vendor | = 3.8.1 | – |
| ibm mq operator | vendor | = 3.9.0 | – |
| ibm mq operator | vendor | = 3.9.1 | – |
| ibm mq operator | vendor | = 3.9.2 | – |
| ibm mq operator | vendor | = 4.0.0 | – |
| ibm mq operator | vendor | = 4.0.1 | – |
| ibm mq operator | vendor | = 4.0.2 | – |
| ibm mq operator | vendor | = 4.0.3 | – |
| ibm mq operator | vendor | = 4.0.4 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.1 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.0 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.5 | – |
| ibm supplied mq advanced container images | vendor | = 9.3.0.0 | – |
| ibm mq operator | vendor | >= 3.3.0, <= 4.0.4 | 4.0.5, 4.1.0 |
kubectl get csv -A | grep -i ibm-mq (OpenShift) or helm list -Akubectl get qmgr -A -o yaml (spec.version and image)2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-4.0.4, or the image is in the 9.3.0.x, 9.4.x (up to 9.4.0.26-r1 for SC2), or 10.0.0.0-r1 to 10.0.0.5-r1 rangesv4.1.0 with MQ Advanced image 10.0.1.0-r1; SC2 stream to Operator v4.0.5 with image 10.0.0.5-r2, or v3.2.30 with image 9.4.0.26-r2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
This page as .md · .json · in your agent: get_signal("CVE-2026-10743")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.