This vulnerability is an improper validation of message header structure length fields in IBM MQ Appliance. An authenticated attacker can exploit the flaw to read sensitive information from message headers or trigger a denial of service, as the system fails to correctly verify length values before processing. The weakness is classified as CWE‑124, indicating an issue with buffer handling.

Affected products include IBM MQ Appliance versions 9.4 LTS, 9.4 CD – M2003, 9.4 CD – M2002, and 10 LTS. Specifically, vulnerable builds are IBM MQ 9.4.0.0 through 9.4.0.26, 9.4.1.0 through 9.4.5.3, and 10.0.0.1 through 10.0.0.5. All entries are based on IBM’s CVE advisory and cover the corresponding firmware releases listed in the solution section.

The CVSS score of 5.4 suggests medium overall severity, and the EPSS information is not available, indicating no current estimate of exploitation probability. The vulnerability requires local or remote authenticated access, which limits immediate threat to insiders or compromised accounts. Although the vulnerability is not listed in CISA KEV, operators should still prioritize remediation due to the potential for sensitive data exposure or service disruption.