---
id: "CVE-2026-11376"
kind: "vulnerability"
aliases: ["CVE-2026-11376"]
title: "IBM MQ: integer overflow in subscriptions lets authenticated users crash or run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM MQ", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": "9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5", "ecosystem": "vendor"}, {"name": "IBM MQ Appliance", "fixed": ["9.4.0.30", "9.4.5.4", "10.0.0.6"], "affected": "9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "enterprise", "ibm-mq", "infrastructure", "messaging", "self-hosted"]
not_affected_if: ["client-only-install", "no-authenticated-access", "patched-version", "unaffected-version"]
published_at: "2026-11-04T21:17:56+00:00"
first_seen_at: "2026-11-04T21:49:18+00:00"
updated_at: "2026-11-04T21:54:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11376", "first_seen_at": "2026-11-04T21:49:18+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376", "first_seen_at": "2026-11-04T21:54:48+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376", "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376"]}]
exploit_sources: []
---

# IBM MQ: integer overflow in subscriptions lets authenticated users crash or run code

IBM MQ mishandles subscription requests with crafted buffer size values, causing an integer overflow. An authenticated attacker can cause a denial of service or potentially execute arbitrary code on the queue manager.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ affected 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0
- vendor:IBM MQ Appliance affected 9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5 fixed 9.4.0.30, 9.4.5.4, 10.0.0.6

## How to check

Run 'dspmqver' on each MQ server (or Appliance firmware version) and compare with the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS/CD. Only the Server component is affected; client-only installs are not listed. Appliance: 9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.1-10.0.0.5.

## Fix

IBM MQ 9.2 LTS: cumulative security update 9.2.0.46. 9.3 LTS: 9.3.0.43. 9.4 LTS: fix pack 9.4.0.30. 10.0 LTS: 10.0.0.6. 9.4 CD and 10.0 CD: upgrade to 10.0.1.0. Appliance: 9.4 LTS 9.4.0.30; 10 LTS 10.0.0.6; 9.4 CD M2002 9.4.5.4; M2003 10.0.0.6 (APAR DT473422).

## Timeline

- 2026-11-04T21:49:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11376
- 2026-11-04T21:54:48+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376 — Read both IBM bulletins (MQ 29 Oct, MQ Appliance 23 Oct 2026). Fixes and ranges from IBM. No exploitation or PoC seen (not searched on X; low-profile authenticated bug). Distributed-MQ bulletin has empty workarounds section; Appliance says None.

## Documents

- [advisory] IBM Security Bulletin: IBM MQ CVE-2026-11376 https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-11376
- [advisory] IBM Security Bulletin: IBM MQ Appliance CVE-2026-11376 https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-11376

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_