{"id":"CVE-2026-12538","kind":"vulnerability","aliases":["CVE-2026-12538"],"related":[],"title":"IBM MQ: malformed message headers leak data or crash the queue manager","description":"IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.","summary":"IBM MQ does not properly validate the length fields in message header structures. An authenticated attacker can read sensitive information or cause a denial of service.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-mq","messaging","runtime","self-hosted"],"not_affected_if":["no-mq-installed","unaffected-version"],"how_to_check":"- Check the installed IBM MQ version with `dspmqver` and compare it with the affected ranges: 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5.","fix":"- Move to a release above the affected ranges listed in the NVD entry; the exact fixed versions are not stated in the sources.","status":"open","published_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:51:24+00:00","updated_at":"2026-11-04T21:51:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T21:51:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release above the affected ranges listed in the NVD entry; the exact fixed versions are not stated in the sources.","reach":"network","title":"IBM MQ: malformed message headers leak data or crash the queue manager","impact":"medium","summary":"IBM MQ does not properly validate the length fields in message header structures. An authenticated attacker can read sensitive information or cause a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-mq","messaging","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads sensitive data or crashes the queue manager","analyst_note":"Find the IBM security bulletin for CVE-2026-12538 to confirm the fixed versions and any configuration that changes exposure.","how_to_check":"- Check the installed IBM MQ version with `dspmqver` and compare it with the affected ranges: 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-mq-installed"],"who_is_affected":"Teams that run IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, or 10.0.0.1 to 10.0.0.5 are exposed. The attacker must hold valid credentials to an MQ connection. Systems on other MQ versions, or with no MQ installed, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4172,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12538':15A,18A '-2026':14A,17A '10.0.0.1':62C '10.0.0.5':64C '9.4.0.0':55C '9.4.0.26':57C '9.4.1.0':58C '9.4.5.3':60C 'allow':66C 'attack':42B,69C 'authent':41B,68C 'caus':48B,75C 'could':65C 'crash':9A 'cve':13A,16A 'data':7A 'denial':50B,77C 'due':80C 'field':35B,89C 'header':5A,38B,86C 'host':26B 'ibm':1A,20B,27B,53C 'ibm-mq':19B 'improp':82C 'inform':46B,73C 'leak':6A 'length':34B,88C 'malform':3A 'manag':12A 'messag':4A,22B,37B,85C 'mq':2A,21B,28B,54C 'obtain':71C 'proper':31B 'queue':11A 'read':44B 'runtim':23B 'self':25B 'self-host':24B 'sensit':45B,72C 'servic':52B,79C 'structur':39B,87C 'valid':32B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, or 10.0.0.1 to 10.0.0.5 are exposed. The attacker must hold valid credentials to an MQ connection. Systems on other MQ versions, or with no MQ installed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmmq","medium","messaging","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12538","severity":null,"published_at":"2026-11-04T21:18:11+00:00","modified_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}