A buffer overflow occurs in IBM MQ when an attacker supplies an improperly sized queue name, allowing remote exploitation by a user with queue manager control or a man‑in‑the‑middle computer on an unencrypted channel. The overflow can corrupt memory in the message consumer process, leading to a crash and subsequent denial of service for client applications consuming messages asynchronously. This flaw is classified as CWE‑120.

The vulnerability affects IBM MQ Advanced container images and the IBM MQ Operator. Specific affected builds include MQ Operator versions v4.0.5, v3.2.30, and earlier releases that use the related container images: IBM MQ Advanced container images 10.0.0.5‑r2, 10.0.1.0‑r1, 9.4.0‑series, and 9.3.0‑series. Updated images are available with versions v4.1.0 for the operator and 10.0.1.0‑r1 or newer for the containers.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires either control over the queue manager or the ability to intercept traffic on an unencrypted channel. An attacker with those capabilities can trigger a denial of service in targeted client applications, potentially disrupting business operations. The likelihood of exploitation depends on the network exposure of unencrypted MQ channels and the presence of privileged accounts that can issue queue commands.