{"id":"CVE-2026-11376","kind":"vulnerability","aliases":["CVE-2026-11376"],"related":[],"title":"IBM MQ: integer overflow in subscriptions lets authenticated users crash or run code","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.","summary":"IBM MQ mishandles subscription requests with crafted buffer size values, causing an integer overflow. An authenticated attacker can cause a denial of service or potentially execute arbitrary code on the queue manager.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":"9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5","ecosystem":"vendor"},{"name":"IBM MQ Appliance","fixed":["9.4.0.30","9.4.5.4","10.0.0.6"],"affected":"9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","enterprise","ibm-mq","infrastructure","messaging","self-hosted"],"not_affected_if":["client-only-install","no-authenticated-access","patched-version","unaffected-version"],"how_to_check":"Run 'dspmqver' on each MQ server (or Appliance firmware version) and compare with the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS/CD. Only the Server component is affected; client-only installs are not listed. Appliance: 9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5.","fix":"IBM MQ 9.2 LTS: cumulative security update 9.2.0.46. 9.3 LTS: 9.3.0.43. 9.4 LTS: fix pack 9.4.0.30. 10.0 LTS: 10.0.0.6. 9.4 CD and 10.0 CD: upgrade to 10.0.1.0. Appliance: 9.4 LTS 9.4.0.30; 10 LTS 10.0.0.6; 9.4 CD M2002 9.4.5.4; M2003 10.0.0.6 (APAR DT473422).","status":"open","published_at":"2026-11-04T21:17:56+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","triaged_at":"2026-11-04T21:50:36+00:00","updated_at":"2026-11-04T21:54:48+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-04T21:50:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: integer overflow in subscriptions lets authenticated users crash or run code","impact":"high","summary":"IBM MQ mishandles subscription requests with crafted buffer size values, causing an integer overflow. An authenticated attacker can cause a denial of service or potentially execute arbitrary code on the queue manager.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-mq","messaging","enterprise"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker crashes the queue manager or potentially runs arbitrary code on it","analyst_note":"Sources give no fixed version or vendor advisory link; check IBM's security bulletin for CVE-2026-11376 for the fixed versions and any workaround.","how_to_check":"- Check the installed IBM MQ version against the affected ranges in the sources (9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, 10.0.0.0 through 10.0.0.5 LTS and CD)\n- Confirm which queue managers accept subscription requests from client applications","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-access"],"who_is_affected":"IBM MQ queue managers in the listed version ranges are exposed, and the attacker must hold valid credentials for the messaging system. Installations on versions outside those ranges are not listed as affected. The sources do not say which configurations are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4253,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no fixed version or vendor advisory link; check IBM's security bulletin for CVE-2026-11376 for the fixed versions and any workaround.","search":"'-11376':16A,19A '-2026':15A,18A '10.0.0.0':86C '10.0.0.5':88C '9.2.0.0':69C '9.2.0.44':71C '9.3.0.0':73C '9.3.0.42':75C '9.4.0.0':77C,81C '9.4.0.26':79C '9.4.5.1':83C 'allow':93C 'appliance':24A 'arbitrari':61B,106C 'attack':51B,96C 'authent':8A,25B,50B,95C 'buffer':42B,119C 'caus':45B,53B,98C 'cd':84C,91C 'code':13A,62B,107C 'could':92C 'craft':41B,118C 'crash':10A 'cve':14A,17A 'denial':55B,100C 'due':108C 'enterpris':26B 'execut':60B,105C 'host':34B 'ibm':1A,20A,22A,28B,35B,67C 'ibm-mq':27B 'infrastructur':30B 'integ':3A,47B,111C 'let':7A 'lts':72C,76C,80C,89C 'manag':66B 'messag':31B 'mishandl':37B 'mq':2A,21A,23A,29B,36B,68C 'overflow':4A,48B,112C 'potenti':59B,104C 'process':114C 'queue':65B 'request':39B,116C 'run':12A 'self':33B 'self-host':32B 'servic':57B,102C 'size':43B,120C 'subscript':6A,38B,115C 'user':9A 'valu':44B,121C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ queue managers (the Server component) on the listed versions, and IBM MQ Appliance on the listed firmware. An attacker needs valid credentials to send crafted subscription requests, so exposure is highest where many apps or partners can authenticate to the queue manager. IBM names denial of service and potentially code execution on the queue manager. Client-only installs are not listed as affected.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:54:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376","run_id":1720},"products":{"at":"2026-11-04T21:54:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376","run_id":1720},"how_to_check":{"at":"2026-11-04T21:54:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376","run_id":1720},"who_affected":{"at":"2026-11-04T21:54:48Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376","run_id":1720}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ibmmq","ibmmqappliance","mq","mqappliance"],"ptokens":["appliance","ibm","mq"],"labels":["authenticated","enterprise","high","ibmmq","infrastructure","messaging","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11376","severity":null,"published_at":"2026-11-04T21:17:56+00:00","modified_at":"2026-11-04T21:17:56+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","fetched_at":"2026-11-04T21:49:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-11376:1720","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376","severity":null,"published_at":"2026-11-04T21:54:48+00:00","modified_at":"2026-11-04T21:54:48+00:00","first_seen_at":"2026-11-04T21:54:48+00:00","fetched_at":"2026-11-04T21:54:48+00:00","note":"Read both IBM bulletins (MQ 29 Oct, MQ Appliance 23 Oct 2026). Fixes and ranges from IBM. No exploitation or PoC seen (not searched on X; low-profile authenticated bug). Distributed-MQ bulletin has empty workarounds section; Appliance says None.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376","https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376"]}],"documents":[{"id":70886,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376","title":"IBM Security Bulletin: IBM MQ CVE-2026-11376","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70887,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376","title":"IBM Security Bulletin: IBM MQ Appliance CVE-2026-11376","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}