CVE-2026-11375: IBM MQ Buffer Overflow Vulnerability

CVE-2026-11375 Overview

CVE-2026-11375 is a stack-based buffer overflow in IBM MQ that occurs when the queue manager processes XA transaction identifiers. An authenticated attacker with network access to the queue manager can trigger the overflow by submitting malformed transaction identifiers. Successful exploitation can crash the MQ process, resulting in denial of service, or allow arbitrary code execution in the context of the MQ service account. The flaw is classified under CWE-122 (Heap-based Buffer Overflow, referenced by IBM alongside stack-based corruption in the XA path).

Critical Impact
An authenticated attacker can corrupt process memory to crash the queue manager or execute code with MQ service privileges, compromising message brokering across connected applications.

Affected Products

IBM MQ Long Term Support (LTS) releases
IBM MQ Continuous Delivery (CD) releases
IBM MQ 10.0.0.0 (Continuous Delivery)

Discovery Timeline

2026-09-18 - CVE-2026-11375 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-11375

Vulnerability Analysis

IBM MQ implements the X/Open XA specification to coordinate distributed transactions between the queue manager and external resource managers. XA transactions are identified by an XID structure containing a format identifier, a global transaction identifier, and a branch qualifier. The MQ transaction handling code copies these fields into fixed-size stack buffers during transaction processing.

The vulnerable code path does not validate the length of attacker-controlled XID fields before copying them onto the stack. An authenticated client can craft an XA request with oversized identifier data, overrunning the stack buffer and overwriting adjacent stack frames including saved return addresses. The condition is reachable over standard MQ channels, requiring only valid queue manager credentials.

Root Cause

The root cause is missing bounds checking on XA transaction identifier fields prior to a stack copy operation. This maps to CWE-122 memory corruption behavior. Because the overflow occurs on the stack and overwrites control data, the impact extends beyond a simple crash to potential arbitrary code execution.

Attack Vector

Exploitation requires network access to an MQ listener and authenticated credentials capable of initiating transactional operations. The attacker submits an XA command containing malformed identifier fields exceeding the expected size. No user interaction is required. Refer to the IBM Support Page for technical details on the affected code path and fix.

Detection Methods for CVE-2026-11375

Indicators of Compromise

Unexpected queue manager (amqzxma0, amqrmppa) crashes or restarts logged in AMQERR01.LOG.
FDC (First Failure Data Capture) files referencing XA transaction processing or stack corruption.
Abnormal termination signals (SIGSEGV, SIGABRT) on MQ processes coinciding with client XA activity.

Detection Strategies

Inspect MQ channel authentication records and audit logs for authenticated sessions issuing anomalous XA command patterns.
Monitor process memory footprints and thread termination events on MQ hosts for signs of exploitation attempts.
Correlate MQ error logs with EDR telemetry to identify child process spawning by MQ service accounts, which would indicate successful code execution.

Monitoring Recommendations

Forward MQ error logs, FDC captures, and OS-level process telemetry to a central SIEM for correlation.
Alert on new outbound network connections or shell invocations originating from MQ service processes.
Track authentication events for MQ administrative and application users to identify credential misuse preceding exploitation.

How to Mitigate CVE-2026-11375

Immediate Actions Required

Apply the IBM MQ security update referenced in the IBM Support Page to all affected LTS and CD deployments.
Inventory queue managers exposed to untrusted networks and prioritize patching internet-reachable listeners first.
Rotate credentials for MQ users with transactional privileges and review channel authentication (CHLAUTH) rules.

Patch Information

IBM has published fixes for affected LTS and Continuous Delivery streams, including IBM MQ 10.0.0.0. Consult the IBM Support Page for the specific fix pack, iFix identifiers, and version-to-patch mapping applicable to your deployment.

Workarounds

Restrict network access to MQ listener ports using firewalls or network segmentation so only trusted application hosts can connect.
Enforce strict CHLAUTH rules to limit which users and IP ranges can open transactional channels.
Disable or restrict XA transaction support on queue managers that do not require distributed transaction coordination.

bash

# Example CHLAUTH restriction limiting SVRCONN channel access by IP and user
runmqsc QMGR1 <<EOF
SET CHLAUTH('APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.20.30.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
SET CHLAUTH('APP.SVRCONN') TYPE(BLOCKUSER) USERLIST('*MQADMIN') ACTION(REPLACE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF