The vulnerability is a heap buffer overflow that can be triggered when an authenticated attacker processes MQPUT or MQPUT1 operations with malformed message handle properties. The overflow can lead to a denial‑of‑service or, in the worst case, arbitrary code execution on the IBM MQ Queue Manager. The weakness corresponds to CWE‑122, a classic buffer overflow scenario that can compromise integrity and availability of the messaging system.

Affected deployments include IBM MQ Advanced container images and IBM MQ Operator running on Kubernetes or OpenShift. Specifically, IBM MQ Operator v4.1.0 (CD release), v4.0.5 (SC2 release) and v3.2.30 (SC2 release) are impacted, as are the underlying MQ Advanced container images 10.0.1.0‑r1, 10.0.0.5‑r2 and 9.4.0.26‑r2. These version combinations are listed in the IBM security bulletin and are available in the provided container image digests.

The CVSS score is 8.8, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the queue manager, so an attacker must first compromise or have legitimate credentials. If the attacker can perform MQPUT operations, system availability can be halted, and the potential for code execution presents a significant risk to confidentiality and integrity. Organizations should treat this as a high‑risk vulnerability in environments where external actors can obtain authorized credentials.