CVE-2026-12550

Undergoing Analysis Undergoing Analysis - In Progress

IBM MQ Information Disclosure and DoS Vulnerability

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: IBM Corporation

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-12550

EUVD

EUVD-2026-117071

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	MQ	9.2.0.0
IBM	MQ	9.3.0.0
IBM	MQ	9.4.0.0
IBM	MQ	9.4.0.0
IBM	MQ	10.0.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

IBM MQ versions 9.2.0.0 through 10.0.0.5 contain a vulnerability where improper validation of message selection parameters allows an authenticated attacker to obtain sensitive information or cause a denial of service. This is classified as a heap-based buffer overflow (CWE-122) with moderate severity (CVSS 5.4).

Detection Guidance

Detecting this vulnerability requires checking the installed IBM MQ version against affected releases. Use commands like 'dspmqver' on IBM MQ systems to verify version details. Monitor network traffic for unusual patterns or crashes in IBM MQ components. Check IBM MQ error logs for heap-based buffer overflow indicators or message selection parameter errors.

Impact Analysis

An attacker could exploit this to crash the IBM MQ server (denial of service) or access sensitive data. This requires authentication but could disrupt messaging services or lead to information leaks in affected environments.

Mitigation Strategies

Apply the latest cumulative security updates for IBM MQ 9.2 LTS and 9.3 LTS. Install fix packs for IBM MQ 9.4 LTS. Upgrade to newer versions if using IBM MQ 9.4 CD or 10.0.0.0 through 10.0.0.5. Ensure all IBM MQ components are updated to patched versions to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-12550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...