This vulnerability is an integer overflow that allows a remote authenticated attacker to cause a denial of service and perform limited memory corruption. The flaw resides in the processing of input data that can overflow a signed integer, leading to a crash and loss of service. The impact is restricted to the affected IBM MQ instance and does not provide arbitrary code execution or full system compromise.

IBM MQ versions 9.2 LTS, 9.3 LTS, 9.4 LTS, 10.0 LTS and their CD releases are affected. The specific vulnerable release ranges include 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. The vulnerability is mitigated by applying the cumulative security updates or fix packs listed in the citation.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, making exploitation probability unknown, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires the attacker to possess valid authentication credentials to the MQ server, implying an insider or compromised account could trigger the service interruption. Once the integer overflow is triggered, the MQ server will crash, leading to a denial of service for all clients connected to that instance.