CVE-2026-12538
Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ Message Header Length Validation Flaw

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-12538
EUVD
EUVD-2026-117072

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
IBM MQ Appliance 9.4.0.0
IBM MQ Appliance 9.4.1.0
IBM MQ Appliance 10.0.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM MQ versions 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 allows an authenticated attacker to access sensitive information or disrupt service. It occurs due to improper validation of message header structure length fields.

Detection Guidance

Detecting this vulnerability requires checking the installed IBM MQ versions against the affected ranges. Use commands like 'dspmqver' on IBM MQ systems to verify version details. Monitor network traffic for malformed message headers that may indicate exploitation attempts.

Impact Analysis

An attacker could exploit this to steal sensitive data or cause service disruptions. The impact includes unauthorized information access and potential downtime for IBM MQ services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive information, which may violate data protection requirements under GDPR and HIPAA. Exposure of sensitive data due to improper validation could result in non-compliance with these regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Apply the latest IBM MQ patches for versions 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 to address improper message header validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...