IBM MQ containers and operator can be triggered by an authenticated attacker to send malformed compressed data, which causes a minor out‑of‑bounds read inside the MQ server. The read is bounded and no sensitive data is revealed; the request is simply rejected, but the vulnerability demonstrates a memory corruption flaw that could be leveraged for denial or further exploitation. The associated weakness aligns with CWE‑125, detailing a buffer overread condition. The CVSS score of 3.1 reflects the low impact and limited scope of the fault.

Affected products include IBM MQ Operator versions 4.1.0 CD, 4.0.5 SC2, and 3.2.30 SC2, each containing IBM MQ Advanced container images 10.0.1.0‑r1, 10.0.0.5‑r2, or 9.4.0.26‑r2 respectively. The container image releases 10.0.1.0‑r1 and 10.0.0.5‑r2 also contain the vulnerable code. All deployments using these operator or image versions are susceptible unless patched to the specified releases.

The CVSS score indicates low severity. EPSS information is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. An attacker would need valid MQ credentials and the ability to send a specially crafted compressed payload to trigger the read. The lack of data leakage reduces immediate risk, but the flaw could serve as a foothold for further attacks or a stepping stone in a larger exploit chain.