CVE-2026-10574 Overview
CVE-2026-10574 is a heap buffer overflow vulnerability in IBM MQ that affects the processing of MQPUT and MQPUT1 operations. An authenticated attacker can send malformed message handle properties to trigger memory corruption on the queue manager. Successful exploitation can cause a denial of service or allow arbitrary code execution in the context of the IBM MQ process. The flaw is classified as a heap-based buffer overflow [CWE-122] and is reachable over the network with low attack complexity.
Critical Impact
Authenticated attackers can crash the queue manager or execute arbitrary code by submitting malformed message handle properties through standard MQPUT/MQPUT1 message flow.
Affected Products
- IBM MQ (queue manager components processing message handle properties)
- Refer to the IBM Support Page for the complete list of affected versions and fix packs
- Any application interacting with vulnerable IBM MQ instances via MQPUT or MQPUT1
Discovery Timeline
- 2026-10-19 - CVE-2026-10574 published to the National Vulnerability Database
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-10574
Vulnerability Analysis
IBM MQ exposes the MQPUT and MQPUT1 verbs so applications can place messages onto a queue. Both verbs accept message handle properties that describe metadata attached to the message. The queue manager parses these properties when the message is submitted. A malformed property structure causes the parser to write past the bounds of a heap allocation. This heap corruption can crash the MQ listener process or be shaped into a controlled write for code execution.
Because the vulnerable code path executes inside the queue manager, the compromise affects a central messaging component. Any application that trusts message delivery through the queue manager is downstream of the exploit. The attack requires valid credentials but no user interaction and originates over the network.
Root Cause
The root cause is improper bounds checking when processing message handle properties supplied to MQPUT and MQPUT1. The property parser allocates a destination buffer sized against assumed field lengths. Malformed input causes copy operations to exceed that allocation. The condition maps to [CWE-122] heap-based buffer overflow.
Attack Vector
An authenticated client with the ability to put messages onto a queue crafts a message handle property that violates expected size or type assumptions. The client issues an MQPUT or MQPUT1 call to deliver the payload. The queue manager processes the property and corrupts adjacent heap memory. Technical details are available on the IBM Support Page.
No verified proof-of-concept code is available for CVE-2026-10574.
See the IBM advisory for vendor-provided technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-10574
Indicators of Compromise
- Unexpected queue manager crashes or AMQ error entries referencing message property parsing failures
- Abnormal FDC (First Failure Data Capture) files generated in the IBM MQ errors directory
- MQPUT or MQPUT1 calls from unusual client identifiers followed by listener restarts
Detection Strategies
- Monitor IBM MQ error logs for repeated parser faults, segmentation violations, or MQRC_UNEXPECTED_ERROR events tied to specific channels
- Correlate authentication events with sudden queue manager restarts to identify suspect accounts
- Inspect message flow telemetry for unusually large or malformed property fields on inbound MQPUT operations
Monitoring Recommendations
- Forward IBM MQ error logs and FDC artifacts to a centralized logging platform for anomaly review
- Alert on queue manager process restarts outside maintenance windows
- Track authenticated channel usage and flag new or dormant principals submitting high volumes of property-heavy messages
How to Mitigate CVE-2026-10574
Immediate Actions Required
- Apply the IBM-provided fix listed on the IBM Support Page as soon as it is validated in a test environment
- Audit MQ user accounts and revoke put authority from principals that do not require it
- Enforce TLS and channel authentication records to restrict which clients can connect to queue managers
Patch Information
IBM has published remediation guidance for CVE-2026-10574 on the official advisory. Review the IBM Support Page for fix pack identifiers, affected version ranges, and upgrade procedures. Apply the recommended fix pack to every queue manager instance in the environment.
Workarounds
- Restrict MQPUT and MQPUT1 authority using setmqaut so only trusted application identities can place messages
- Use channel authentication records (CHLAUTH) to block unknown client IP ranges and user IDs
- Place queue managers behind network segmentation that limits exposure to authenticated application tiers only
# Example: restrict put authority to a specific application group
setmqaut -m QM1 -t queue -n APP.QUEUE -g mqapps +put
setmqaut -m QM1 -t queue -n APP.QUEUE -g everyone -put
# Example: block unknown client user IDs via CHLAUTH
runmqsc QM1 <<EOF
SET CHLAUTH('*') TYPE(BLOCKUSER) USERLIST('*MQADMIN','nobody')
SET CHLAUTH('SYSTEM.*') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS)
EOF
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
