Impact
An off-by-one buffer overflow is triggered when IBM MQ processes object names supplied by an authenticated user. The overflow can corrupt memory and lead to process instability or crash, effectively denying service to the affected MQ instance.
Affected Systems
IBM MQ Advanced container images and IBM MQ Operator are impacted. Versions before IBM MQ Advanced 10.0.1.0-r1 and before IBM MQ Operator v4.1.0 CD (including earlier reactive releases such as v4.0.5 SC2 with MQ Advanced 10.0.0.5-r2 and v3.2.30 SC2 with MQ Advanced 9.4.0.26-r2) contain the flaw.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate severity. The vulnerability requires authenticated access to the MQ system, limiting the attack surface to legitimate users. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, suggesting that the exploitation probability is unknown, but the potential to crash the MQ service makes remediation important.
OpenCVE Enrichment