CVE-2026-10575: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2026-10575 is a heap-based buffer overflow vulnerability in IBM MQ that allows an authenticated attacker to cause a denial of service or potentially escalate privileges by sending MQPUT operations with malformed distribution headers. It affects IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. The vulnerability was published on September 18, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, IBM Support).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), occurring when IBM MQ processes MQPUT operations containing malformed distribution headers. An attacker with low-privilege authenticated network access can craft a malicious MQPUT message with a specially formed distribution header that triggers an out-of-bounds write in heap memory. No user interaction is required, and attack complexity is low, making this straightforward to exploit for any authenticated MQ user. The associated CAPEC pattern is CAPEC-92 (Forced Integer Overflow), suggesting the malformed header may cause an integer miscalculation that leads to an undersized heap allocation being overwritten (GitHub Advisory, IBM Support).

Successful exploitation can result in a denial of service by crashing the IBM MQ service, or potentially allow privilege escalation if the heap overflow is leveraged to achieve arbitrary code execution in the context of the MQ process. All three security dimensions are rated High — confidentiality, integrity, and availability — meaning an attacker could potentially access sensitive messages in transit, tamper with message queues, or disrupt business-critical messaging infrastructure. IBM MQ is widely used in enterprise environments for financial transactions, healthcare data exchange, and other critical workflows, amplifying the potential business impact (GitHub Advisory, IBM Support).

As of the disclosure date (September 18, 2026), there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. A vendor patch is available (GitHub Advisory).

• Network: Unusual or malformed MQPUT messages directed at IBM MQ listener ports (default TCP 1414) from authenticated clients; unexpected spikes in MQPUT operation volume.
• Logs: IBM MQ error logs (AMQERR01.LOG) showing abnormal termination events, memory corruption errors, or queue manager crashes following MQPUT operations; entries referencing distribution header parsing failures.
• Process: Unexpected IBM MQ queue manager process (amqzmgr0, amqrmppa) crashes or restarts; elevated privilege processes spawned from MQ service accounts.
• File System: Core dump files generated in the IBM MQ installation directory following service crashes, which may indicate heap corruption events.

IBM has released a patch addressing this vulnerability; administrators should consult the IBM support page at https://www.ibm.com/support/pages/node/7287778 for specific fix pack versions for each affected release stream. As an interim workaround, restrict network access to IBM MQ listener ports to only trusted hosts and limit MQPUT operation permissions to explicitly authorized, trusted authenticated users. Monitor IBM MQ error logs for anomalous MQPUT activity involving malformed distribution headers (IBM Support, GitHub Advisory).