{"id":"CVE-2026-12665","kind":"vulnerability","aliases":["CVE-2026-12665"],"related":[],"title":"IBM MQ Operator: TLS certificate parsing overflow lets remote attacker run code","description":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.","summary":"Stack buffer overflow in IBM MQ (Operator and MQ Advanced container images) when processing TLS certificates with malformed distinguished names during channel connection setup. Unauthenticated remote code execution, CVSS 8.1 (AC:H). IBM lists no workaround and no TLS setting that avoids it.","severity":"high","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":["4.0.5","4.1.0"],"affected":">= 3.3.0, <= 4.0.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","infrastructure","kubernetes","messaging","openshift","rce","tls","vendor"],"not_affected_if":["no-network-exposure","unknown"],"how_to_check":"List the installed operator version, e.g. kubectl get csv -A | grep -i ibm-mq (OpenShift) or helm list -A, and the queue manager image tag (kubectl get qmgr -A -o yaml, look at spec.version and the image). Exposed if the operator is in 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-3.9.2 or 4.0.0-4.0.4, or the image is in IBM's affected list (9.3.0.x, 9.4.x up to 9.4.0.26-r1 for SC2, 9.4.1.0-9.4.5.x, 10.0.0.0-r1 to 10.0.0.5-r1).","fix":"Upgrade: CD stream to Operator v4.1.0 with MQ Advanced image 10.0.1.0-r1; SC2 stream to Operator v4.0.5 with image 10.0.0.5-r2, or v3.2.30 with image 9.4.0.26-r2. LTS (Operator 2.0.x, images 9.3.0.x): the bulletin lists no fix, so confirm with IBM. Until patched, restrict network access to MQ listener ports to trusted clients.","status":"open","published_at":"2026-10-19T17:17:18+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:39:58+00:00","updated_at":"2026-10-23T23:25:44+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:39:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade IBM MQ Operator to a release later than the affected ranges (2.0.x above 2.0.29, 3.2.x above 3.2.29, and 3.3.0 through 3.6.2 to the fixed build); the fixed version numbers are not in the sources.","reach":"network","title":"IBM MQ Operator: TLS certificate parsing overflow lets remote attacker run code","impact":"high","summary":"IBM MQ Operator has a stack buffer overflow when it processes TLS certificates with malformed distinguished names during channel connection setup. A remote attacker who sends such a certificate can execute arbitrary code.","category":"vendor","who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Code runs with the operator's privileges during channel connection setup.","analyst_note":"Find the IBM security bulletin for CVE-2026-12665 to get the fixed operator versions and whether a TLS channel setting is required to reach the flaw.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00054,"input_tokens":3235,"output_tokens":432,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-12665 to get the fixed operator versions and whether a TLS channel setting is required to reach the flaw.","search":"'-12665':15A,18A '-2026':14A,17A '8.1':220B 'ac':221B 'advanc':200B 'advanced':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'allow':236C 'arbitrari':242C 'attack':10A,239C 'avoid':232B 'buffer':192B,248C 'certif':5A,206B,253C 'channel':212B,259C 'code':12A,217B,243C 'connect':213B,260C 'contain':201B 'container':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'could':235C 'cve':13A,16A 'cvss':219B 'distinguish':209B,256C 'due':244C 'establish':261C 'execut':218B,241C 'h':222B 'ibm':1A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A,182B,195B,223B,233C 'ibm-mq':181B 'imag':202B 'images':105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A 'infrastructur':184B 'kubernet':185B 'let':8A 'list':224B 'malform':208B,255C 'messag':186B 'mq':2A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A,179A,183B,196B,199B,234C 'name':210B,257C 'openshift':187B 'oper':3A,197B 'operator':21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,180A 'overflow':7A,193B,249C 'pars':6A 'process':204B,251C 'rce':188B 'remot':9A,216B,238C 'run':11A 'set':230B 'setup':214B 'stack':191B,247C 'supplied':101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A 'tls':4A,189B,205B,229B,252C 'unauthent':215B 'vendor':190B 'workaround':226B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12665","severity":null,"published_at":"2026-10-19T17:17:18+00:00","modified_at":"2026-10-23T17:21:42+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-12665:437","url":null,"severity":null,"published_at":"2026-10-23T23:25:44+00:00","modified_at":"2026-10-23T23:25:44+00:00","first_seen_at":"2026-10-23T23:25:44+00:00","fetched_at":"2026-10-23T23:25:44+00:00","note":"Read IBM bulletin for MQ Operator/container images (primary) and CVE record. Fixed: CD v4.1.0, SC2 v4.0.5 and v3.2.30. No LTS fix listed (v2.0.x). Bulletin says workarounds: None; no TLS setting gates it. No exploitation or PoC found; social not searched. Same CVE also in MQ Appliance bulletin (APAR DT474965), which is a separate product."}],"documents":[{"id":1957,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31","title":"IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1958,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-stack-buffer-overflow-vulnerability-cve-2026-12665","title":"IBM Security Bulletin: IBM MQ Appliance stack buffer overflow (CVE-2026-12665)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1959,"url":"https://www.cve.org/CVERecord?id=CVE-2026-12665","title":"CVE Record CVE-2026-12665 (CNA: IBM)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}