CVE-2026-10743: IBM MQ DOS Vulnerability in MQOPEN

CVE-2026-10743 Overview

CVE-2026-10743 affects IBM MQ, allowing an authenticated attacker to trigger a denial of service or corrupt memory. The flaw stems from improper validation of buffer sizes during MQOPEN operations. An attacker with valid credentials can send crafted requests over the network to exploit the weakness, impacting confidentiality, integrity, and availability of the messaging service.

Critical Impact
Authenticated network attackers can corrupt memory within IBM MQ, enabling denial of service and potential compromise of message broker integrity on affected queue managers.

Affected Products

IBM MQ (versions listed in the vendor advisory)
IBM MQ queue manager components exposing MQOPEN operations
Deployments where authenticated clients can reach the queue manager over the network

Discovery Timeline

2026-10-19 - CVE CVE-2026-10743 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-10743

Vulnerability Analysis

IBM MQ fails to properly validate buffer sizes supplied to MQOPEN calls. The weakness maps to CWE-1223, which covers improper validation of input values during object access operations. An authenticated client can submit MQOPEN requests with buffer parameters that fall outside expected bounds. The queue manager processes the request without rejecting the malformed input, leading to memory corruption or process termination.

Successful exploitation disrupts message processing for all connected applications. Memory corruption may further permit integrity violations within the broker process, including unauthorized modification of in-flight message data structures.

Root Cause

The root cause is missing or insufficient boundary validation on buffer size fields passed through the MQOPEN API. Trusting client-supplied size values without reconciling them against allocated structures permits out-of-bounds operations inside the queue manager process.

Attack Vector

Exploitation requires network access to the IBM MQ listener and valid credentials to establish a client channel. The attacker crafts an MQOPEN request containing malformed buffer size parameters. The queue manager processes the request, resulting in a crash or corrupted memory state. No user interaction is required. Refer to the IBM Support Page for authoritative technical detail.

// No verified exploit code is publicly available for CVE-2026-10743.
// See the IBM Support advisory for implementation-specific details.

Detection Methods for CVE-2026-10743

Indicators of Compromise

Unexpected IBM MQ queue manager crashes or FDC (First Failure Data Capture) files generated during MQOPEN processing
Abnormal termination of amqzxma0 or related MQ broker processes shortly after authenticated client activity
Repeated failed or malformed MQOPEN requests originating from a single authenticated principal

Detection Strategies

Monitor IBM MQ error logs (AMQERR01.LOG) for recurring errors tied to object open operations or buffer handling
Correlate authentication events on MQ channels with subsequent queue manager restarts or crashes
Inspect network traffic to the MQ listener for malformed MQI protocol frames from authenticated sessions

Monitoring Recommendations

Enable MQ channel authentication records and audit logs for all client connections to establish a baseline
Forward MQ logs and FDC artifacts to a centralized SIEM for correlation with endpoint and identity telemetry
Alert on queue manager process restarts outside of planned maintenance windows

How to Mitigate CVE-2026-10743

Immediate Actions Required

Apply the fix identified in the IBM Support Page for CVE-2026-10743
Restrict MQ channel access to trusted hosts using channel authentication records (CHLAUTH)
Rotate and audit credentials used by MQ clients, removing unused or over-privileged accounts

Patch Information

IBM has published remediation guidance on its support portal. Review the IBM Support Page to identify fixed versions and interim fixes applicable to your IBM MQ deployment, then schedule patching based on exposure.

Workarounds

Limit network reachability to the MQ listener using firewall rules or network segmentation
Enforce least privilege on MQ user IDs so authenticated attackers cannot open sensitive queues
Enable TLS on MQ channels and require mutual authentication to reduce the pool of principals that can reach MQOPEN

bash

# Example: restrict inbound MQ client connections to specific IPs via CHLAUTH
runmqsc QM1 <<EOF
SET CHLAUTH('SYSTEM.DEF.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.0.0.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
SET CHLAUTH('SYSTEM.DEF.SVRCONN') TYPE(BLOCKUSER) USERLIST('*MQADMIN') ACTION(REPLACE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF