The vulnerability is a stack‑buffer overflow that is triggered when IBM MQ processes TLS certificates containing malformed distinguished names during the establishment of a channel connection. An attacker who can supply such a certificate can cause the MQ server to execute arbitrary code. Because the fault occurs in code that runs with the permissions of the MQ process, the impact is a full compromise of the affected device, affecting confidentiality, integrity, and availability of the system and any data handled by the queue manager.

IBM’s MQ Advanced container images and IBM MQ Operator are affected. The specific product releases that contain the flaw are IBM MQ Operator v4.0.5, v4.1.0, and v3.2.30, and the IBM MQ container images 10.0.0.5‑r2 and 10.0.1.0‑r1, which ship with the underlying IBM MQ Advanced Server images 10.0.0.5‑r2 and 10.0.1.0‑r1. All other versions of these products listed in the vendor’s documentation are considered affected until a patched image is deployed.

With a CVSS score of 8.1, this vulnerability represents a high level of severity. The EPSS score is currently not available, and the flaw is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been reported. However, remote code execution is possible from any network location that can initiate a TLS connection to the MQ server, so the attack vector is clearly remote. An attacker must supply a malformed distinguished name in a TLS certificate during the channel establishment, which is a feasible and automated exploit in typical attack scenarios. The risk of exploitation remains significant until the patched container images are deployed and used.