---
id: "CVE-2026-18142"
kind: "vulnerability"
aliases: ["CVE-2026-18142"]
title: "IBM MQ: integer overflow lets authenticated remote user crash service"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "IBM MQ", "fixed": ["9.2.0.46", "9.3.0.43", "9.4.0.30", "10.0.0.6", "10.0.1.0"], "affected": ">= 9.2.0.0, <= 9.2.0.44 LTS; >= 9.3.0.0, <= 9.3.0.42 LTS; >= 9.4.0.0, <= 9.4.0.26 LTS; >= 9.4.0.0, <= 9.4.5.1 CD; >= 10.0.0.0, <= 10.0.0.5", "ecosystem": "vendor"}, {"name": "IBM MQ Appliance", "fixed": ["9.4.0.30", "9.4.5.4", "10.0.0.6"], "affected": "9.4.0.0-9.4.0.26 LTS; 9.4.1.0-9.4.5.3 CD; 10.0.0.0-10.0.0.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-mq", "messaging", "middleware", "mq-appliance", "package"]
not_affected_if: ["version-outside-listed-ranges"]
published_at: "2026-11-04T21:18:13+00:00"
first_seen_at: "2026-11-04T21:49:23+00:00"
updated_at: "2026-11-04T22:13:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18142", "first_seen_at": "2026-11-04T21:49:23+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142", "first_seen_at": "2026-11-04T21:52:42+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142", "https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142"]}]
exploit_sources: []
---

# IBM MQ: integer overflow lets authenticated remote user crash service

IBM says a remote authenticated user can send a malformed MQINQ request that triggers an integer overflow (CWE-190) in IBM MQ, causing denial of service or limited memory corruption. Fixed in 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6 and 10.0.1.0 (CD). No workaround listed. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM MQ affected >= 9.2.0.0, <= 9.2.0.44 LTS; >= 9.3.0.0, <= 9.3.0.42 LTS; >= 9.4.0.0, <= 9.4.0.26 LTS; >= 9.4.0.0, <= 9.4.5.1 CD; >= 10.0.0.0, <= 10.0.0.5 fixed 9.2.0.46, 9.3.0.43, 9.4.0.30, 10.0.0.6, 10.0.1.0
- vendor:IBM MQ Appliance affected 9.4.0.0-9.4.0.26 LTS; 9.4.1.0-9.4.5.3 CD; 10.0.0.0-10.0.0.5 fixed 9.4.0.30, 9.4.5.4, 10.0.0.6

## How to check

Run dspmqver on each queue manager host (Server component) and compare Version to the affected ranges: 9.2.0.0-9.2.0.44 LTS, 9.3.0.0-9.3.0.42 LTS, 9.4.0.0-9.4.0.26 LTS, 9.4.0.0-9.4.5.1 CD, 10.0.0.0-10.0.0.5 LTS/CD. For MQ Appliance, check firmware: 9.4.0.0-9.4.0.26 LTS, 9.4.1.0-9.4.5.3 CD, 10.0.0.0-10.0.0.5.

## Fix

Move to: 9.2 LTS -> cumulative security update 9.2.0.46; 9.3 LTS -> 9.3.0.43; 9.4 LTS -> fix pack 9.4.0.30; 10.0 LTS -> 10.0.0.6; 9.4 CD and 10.0 CD -> 10.0.1.0. MQ Appliance: 9.4 LTS fix pack 9.4.0.30; 9.4 CD M2002 -> 9.4.5.4; 9.4 CD M2003 and 10 LTS -> 10.0.0.6 (or later firmware). IBM tracks it as DT500561.

## Timeline

- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18142
- 2026-11-04T21:52:42+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142 — Read IBM bulletins (distributed MQ 29 Oct, Appliance 23 Oct); fixed versions and trigger (malformed MQINQ) from them. CVE text says 'MQ for z/OS' but bulletin lists distributed Server component; z/OS not confirmed. No exploitation or PoC seen; did not search X. Workarounds: Appliance says none; distributed section blank.

## Documents

- [advisory] IBM Security Bulletin: IBM MQ denial of service (CVE-2026-18142) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-affected-denial-service-vulnerability-cve-2026-18142
- [advisory] IBM Security Bulletin: IBM MQ Appliance integer overflow (CVE-2026-18142) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-integer-overflow-vulnerability-cve-2026-18142

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_