IBM MQ can cause a denial of service or potentially allow an attacker to execute arbitrary code when it processes MQPUT operations containing malformed message options. The vulnerability is a heap buffer overflow (CWE‑122). The official description confirms that the impact is restricted to an authenticated attacker, indicating that only actors with legitimate access to the MQ system can exploit the flaw, but the resulting denial of service or code execution could affect the entire application state.

The affected products are IBM MQ Advanced container images and the IBM MQ Operator. Affected Operator releases include v4.1.0, v4.0.5, and v3.2.30, with corresponding container images 10.0.1.0‑r1, 10.0.0.5‑r2, and 9.4.0.26‑r2. The listed CPEs cover all major version ranges of the MQ Advanced container images and the IBM MQ Operator. If your environment uses any of these image or operator versions, the risk applies.

The CVSS score of 8.8 signals a high severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability requires an authenticated attacker, so it is likely that the attacker has some level of trust or access to the MQ infrastructure, such as being a legitimate user or an internal attacker. Once an authenticated user submits a malicious MQPUT request with crafted options, the heap overflow can crash the MQ process, resulting in a denial of service, or may allow code execution under certain conditions. The absence of a public exploit does not mitigate the risk because the vulnerability is straightforward to trigger once access is granted.