{"id":"CVE-2026-18142","kind":"vulnerability","aliases":["CVE-2026-18142"],"related":[],"title":"IBM MQ: integer overflow lets authenticated remote user crash service","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.","summary":"IBM says a remote authenticated user can send a malformed MQINQ request that triggers an integer overflow (CWE-190) in IBM MQ, causing denial of service or limited memory corruption. Fixed in 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6 and 10.0.1.0 (CD). No workaround listed. No exploitation or public PoC found.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM MQ","fixed":["9.2.0.46","9.3.0.43","9.4.0.30","10.0.0.6","10.0.1.0"],"affected":">= 9.2.0.0, <= 9.2.0.44 LTS; >= 9.3.0.0, <= 9.3.0.42 LTS; >= 9.4.0.0, <= 9.4.0.26 LTS; >= 9.4.0.0, <= 9.4.5.1 CD; >= 10.0.0.0, <= 10.0.0.5","ecosystem":"vendor"},{"name":"IBM MQ Appliance","fixed":["9.4.0.30","9.4.5.4","10.0.0.6"],"affected":"9.4.0.0-9.4.0.26 LTS; 9.4.1.0-9.4.5.3 CD; 10.0.0.0-10.0.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-mq","messaging","middleware","mq-appliance","package"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"Run dspmqver on each queue manager host (Server component) and compare Version to the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS/CD. For MQ Appliance, check firmware: 9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.0-10.0.0.5.","fix":"Move to: 9.2 LTS -> cumulative security update 9.2.0.46; 9.3 LTS -> 9.3.0.43; 9.4 LTS -> fix pack 9.4.0.30; 10.0 LTS -> 10.0.0.6; 9.4 CD and 10.0 CD -> 10.0.1.0. MQ Appliance: 9.4 LTS fix pack 9.4.0.30; 9.4 CD M2002 -> 9.4.5.4; 9.4 CD M2003 and 10 LTS -> 10.0.0.6 (or later firmware). IBM tracks it as DT500561.","status":"open","published_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","triaged_at":"2026-11-04T21:50:56+00:00","updated_at":"2026-11-04T22:13:30+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-04T21:50:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: integer overflow lets authenticated remote user crash service","impact":"medium","summary":"IBM MQ versions 9.2 through 10.0 contain an integer overflow that a remote authenticated attacker can trigger. The flaw can cause denial of service and limited memory corruption.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ibm-mq","messaging","middleware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Remote user crashes the queue manager and may corrupt memory.","analyst_note":"Confirm fixed versions and any required configuration from the IBM security bulletin for CVE-2026-18142; sources only list NVD.","how_to_check":"- Run `dspmqver` on the queue manager host and compare the reported version against the affected ranges in the description (for example `9.4.0.26` LTS or `10.0.0.5`).\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Organisations running IBM MQ in the listed version ranges, reachable by a remote user who already has valid credentials. The sources do not name specific configurations that are required, so teams should assume any reachable MQ queue manager in those ranges is in scope. Installations outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4236,"output_tokens":537,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed versions and any required configuration from the IBM security bulletin for CVE-2026-18142; sources only list NVD.","search":"'-18142':13A,16A '-190':49B '-2026':12A,15A '10.0.0.0':98C '10.0.0.5':100C '10.0.0.6':66B '10.0.1.0':68B '9.2.0.0':81C '9.2.0.44':83C '9.2.0.46':63B '9.3.0.0':85C '9.3.0.42':87C '9.3.0.43':64B '9.4.0.0':89C,93C '9.4.0.26':91C '9.4.0.30':65B '9.4.5.1':95C 'allow':105C 'applianc':29B 'appliance':21A 'attack':109C 'authent':6A,35B,108C 'caus':53B,111C 'cd':69B,96C,103C 'corrupt':60B,120C 'could':104C 'crash':9A 'cve':11A,14A 'cwe':48B 'denial':54B,113C 'due':121C 'exploit':74B 'fix':61B 'found':78B 'ibm':1A,17A,19A,23B,31B,51B,79C 'ibm-mq':22B 'integ':3A,46B,124C 'let':5A 'limit':58B,118C 'list':72B 'lts':84C,88C,92C,101C 'malform':40B 'memori':59B,119C 'messag':25B 'middlewar':26B 'mq':2A,18A,20A,24B,28B,52B,80C 'mq-applianc':27B 'mqinq':41B 'overflow':4A,47B,125C 'packag':30B 'perform':117C 'poc':77B 'public':76B 'remot':7A,34B,107C 'request':42B 'say':32B 'send':38B 'servic':10A,56B,115C 'trigger':44B 'user':8A,36B 'workaround':71B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Server component (distributed platforms) or an MQ Appliance in the listed version ranges. An attacker needs valid credentials and the ability to send a request to the queue manager, so the risk is highest where MQ is reachable by many users or other networks. Installations at or above the fixed versions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T21:52:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142","run_id":1712},"products":{"at":"2026-11-04T21:52:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142","run_id":1712},"how_to_check":{"at":"2026-11-04T21:52:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142","run_id":1712},"who_affected":{"at":"2026-11-04T21:52:42Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142","run_id":1712}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmmq","ibmmqappliance","mq","mqappliance"],"ptokens":["appliance","ibm","mq"],"labels":["high","ibmmq","messaging","middleware","mqappliance","package"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18142","severity":null,"published_at":"2026-11-04T21:18:13+00:00","modified_at":"2026-11-04T21:18:13+00:00","first_seen_at":"2026-11-04T21:49:23+00:00","fetched_at":"2026-11-04T21:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18142:1712","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142","severity":null,"published_at":"2026-11-04T21:52:42+00:00","modified_at":"2026-11-04T21:52:42+00:00","first_seen_at":"2026-11-04T21:52:42+00:00","fetched_at":"2026-11-04T21:52:42+00:00","note":"Read IBM bulletins (distributed MQ 29 Oct, Appliance 23 Oct); fixed versions and trigger (malformed MQINQ) from them. CVE text says 'MQ for z/OS' but bulletin lists distributed Server component; z/OS not confirmed. No exploitation or PoC seen; did not search X. Workarounds: Appliance says none; distributed section blank.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142","https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142"]}],"documents":[{"id":70874,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142","title":"IBM Security Bulletin: IBM MQ denial of service (CVE-2026-18142)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70875,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142","title":"IBM Security Bulletin: IBM MQ Appliance integer overflow (CVE-2026-18142)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}