---
id: "CVE-2026-12538"
kind: "vulnerability"
aliases: ["CVE-2026-12538"]
title: "IBM MQ: malformed message headers leak data or crash the queue manager"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ibm-mq", "messaging", "runtime", "self-hosted"]
not_affected_if: ["no-mq-installed", "unaffected-version"]
published_at: "2026-11-04T21:18:11+00:00"
first_seen_at: "2026-11-04T21:49:22+00:00"
updated_at: "2026-11-04T21:51:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12538", "first_seen_at": "2026-11-04T21:49:22+00:00"}]
exploit_sources: []
---

# IBM MQ: malformed message headers leak data or crash the queue manager

IBM MQ does not properly validate the length fields in message header structures. An authenticated attacker can read sensitive information or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM MQ version with `dspmqver` and compare it with the affected ranges: 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5.

## Fix

- Move to a release above the affected ranges listed in the NVD entry; the exact fixed versions are not stated in the sources.

## Timeline

- 2026-11-04T21:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12538

## From the sources

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_