{"id":"CVE-2026-12727","kind":"vulnerability","aliases":["CVE-2026-12727"],"related":[],"title":"IBM MQ Operator: off-by-one buffer overflow crashes processes via crafted object names","description":"IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.","summary":"IBM MQ Operator has an off-by-one buffer overflow when it processes specially crafted object names. An authenticated attacker can cause potential process instability, such as a crash.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","mq-operator","openshift","vendor"],"not_affected_if":["no-authenticated-users","unaffected-version"],"how_to_check":"- Check the installed IBM MQ Operator version with `oc get csv` or `kubectl get csv` and compare it to the affected ranges 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2.","fix":"- Move the IBM MQ Operator to a fixed release. The fixed version numbers are unknown from the sources; check IBM's security bulletin for the release that addresses CVE-2026-12727.","status":"open","published_at":"2026-10-19T17:17:19+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:39:35+00:00","updated_at":"2026-10-25T04:39:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move the IBM MQ Operator to a fixed release. The fixed version numbers are unknown from the sources; check IBM's security bulletin for the release that addresses CVE-2026-12727.","reach":"unknown","title":"IBM MQ Operator: off-by-one buffer overflow crashes processes via crafted object names","impact":"low","summary":"IBM MQ Operator has an off-by-one buffer overflow when it processes specially crafted object names. An authenticated attacker can cause potential process instability, such as a crash.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","openshift","mq-operator"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user crashes an MQ process via crafted object name","analyst_note":"Find the fixed operator versions and the reach of the flaw in IBM's security bulletin, which the NVD entry links to.","how_to_check":"- Check the installed IBM MQ Operator version with `oc get csv` or `kubectl get csv` and compare it to the affected ranges 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2.","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-users"],"who_is_affected":"Teams running the IBM MQ Operator in the affected ranges 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, or 3.3.0 to 3.6.2. The attacker needs an authenticated account that can submit object names, so teams with tight access control on MQ object creation face less exposure. Sources do not say which deployments are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3609,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12727':18A,21A '-2026':17A,20A 'advanced':106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A 'allow':223C 'attack':210B,226C 'authent':209B,225C 'buffer':8A,199B,239C 'caus':212B,228C 'container':107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179A 'could':222C 'craft':13A,205B,244C 'crash':10A,219B 'cve':16A,19A 'due':232C 'ibm':1A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A,182B,190B,220C 'ibm-mq':181B 'images':108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A,180A 'instabl':215B,231C 'kubernet':184B 'mq':2A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A,183B,186B,191B,221C 'mq-oper':185B 'name':15A,207B,246C 'object':14A,206B,245C 'off-by-on':4A,195B,235C 'one':7A,198B,238C 'openshift':188B 'oper':3A,187B,192B 'operator':24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,102A 'overflow':9A,200B,240C 'potenti':213B,229C 'process':11A,203B,214B,230C,242C 'special':204B,243C 'supplied':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'vendor':189B 'via':12A","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator in the affected ranges 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, or 3.3.0 to 3.6.2. The attacker needs an authenticated account that can submit object names, so teams with tight access control on MQ object creation face less exposure. Sources do not say which deployments are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12727","severity":null,"published_at":"2026-10-19T17:17:19+00:00","modified_at":"2026-10-23T17:08:10+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}