The flaw in IBM MQ for HPE NonStop allows an authenticated attacker to supply malformed message headers that drive an out‑of‑bounds read, giving the attacker the ability to expose sensitive information or trigger a service crash. The weakness is a classic out‑of‑bounds read (CWE‑125). No injection or remote code execution is described; the impact is limited to denial of service and data leakage within the privileged environment.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40. The vulnerability exists in the 8.1.0.40 release and earlier. Systems running the default 8.1.0.40 or any earlier 8.1.x build are affected.

Given an authenticated user can exploit the bug, it requires legitimate credentials on the MQ server. The CVSS base score of 8.1 indicates a high‑severity flaw. The EPSS score is not available, so no current exploitation probability estimate can be applied. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to construct messages with an invalid header offset, which could be done over an established connection. Because the flaw relies on internal state and correct messaging, the likelihood of successful exploitation in the wild is moderate, but once a malicious message is sent the service will crash, exposing the system to denial of service and possible disclosure of memory contents.