CVE-2026-10572 Overview
CVE-2026-10572 is a heap buffer overflow vulnerability in IBM MQ message queuing middleware. The flaw occurs when the server processes MQPUT operations that carry malformed message options. An authenticated attacker with network access can trigger memory corruption on the heap. Successful exploitation causes denial of service or potential arbitrary code execution within the IBM MQ process context.
The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow. IBM MQ is widely deployed as a backbone for enterprise message-oriented middleware, which raises the operational impact of this issue in production environments.
Critical Impact
An authenticated attacker sending crafted MQPUT requests with malformed message options can corrupt heap memory, crash the queue manager, or achieve arbitrary code execution.
Affected Products
- IBM MQ (refer to the IBM Support Page for affected versions)
- IBM MQ queue manager components processing MQPUT operations
- Environments exposing IBM MQ listeners to authenticated clients
Discovery Timeline
- 2026-10-19 - CVE-2026-10572 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-10572
Vulnerability Analysis
The vulnerability resides in the IBM MQ code path that handles MQPUT message placement operations. When a client submits a message with malformed options in the Message Queue Interface (MQI) structures, the server fails to correctly validate buffer boundaries before copying attacker-controlled data onto the heap. The resulting out-of-bounds write corrupts adjacent heap metadata and object state.
An authenticated attacker who can reach a queue manager over the network can exploit this flaw without user interaction. The impact extends to confidentiality, integrity, and availability of the queue manager process. Because IBM MQ frequently runs with elevated privileges and brokers traffic between business-critical applications, compromise of the queue manager can cascade across downstream systems.
At the time of publication, no public exploit is available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper validation of length or option fields within message descriptors supplied to the MQPUT call. The server allocates a heap buffer sized against trusted assumptions, then copies option-derived data without re-checking the destination capacity. This classic [CWE-122] pattern allows the write to spill beyond the allocated region.
Attack Vector
Exploitation requires an authenticated session to the queue manager and network reachability to the MQ listener. The attacker crafts an MQPUT request containing malformed message options that drive the vulnerable copy routine. No user interaction on the server side is required to trigger the overflow.
No verified proof-of-concept code is available. Technical implementation details are described in the IBM Support Page.
Detection Methods for CVE-2026-10572
Indicators of Compromise
- Unexpected crashes, restarts, or FDC (First Failure Data Capture) files generated by the IBM MQ queue manager process.
- MQPUT calls originating from unusual client identifiers or source addresses that correlate with queue manager instability.
- Heap corruption signatures in queue manager core dumps following client message activity.
Detection Strategies
- Enable and review IBM MQ error logs (AMQERR01.LOG) for abnormal termination events tied to messaging operations.
- Correlate authentication events on the queue manager with subsequent process crashes to identify suspect sessions.
- Deploy network monitoring on MQ listener ports to flag malformed MQI payloads and anomalous message option fields.
Monitoring Recommendations
- Alert on queue manager process restarts and FDC file creation in near real time.
- Track per-user MQPUT failure rates to surface accounts producing high volumes of malformed requests.
- Monitor privileged account activity against MQ channels, including service accounts used by application integrations.
How to Mitigate CVE-2026-10572
Immediate Actions Required
- Apply the IBM MQ security update referenced on the IBM Support Page as soon as it is available in your change window.
- Restrict network access to MQ listener ports so only trusted application hosts can initiate client connections.
- Audit authenticated MQ users and revoke credentials that are unused, shared, or over-privileged.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Administrators should identify affected queue manager versions and apply the vendor-supplied fix pack or interim fix that addresses the MQPUT option handling flaw.
Workarounds
- Enforce channel authentication records (CHLAUTH) to limit which users and IP ranges can place messages on sensitive queues.
- Apply least-privilege authority records with setmqaut to constrain +put permissions to required principals only.
- Terminate connections from clients that generate repeated malformed MQPUT requests and investigate the source.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
