CVE-2026-11725: IBM MQ Integer Overflow DOS Vulnerability

CVE-2026-11725 Overview

CVE-2026-11725 is an integer overflow vulnerability [CWE-190] in IBM MQ that affects MQINQ request processing. An authenticated attacker with network access can trigger the flaw to cause a denial of service or potentially execute arbitrary code on the affected queue manager. The vulnerability requires only low privileges and no user interaction, making it accessible to any authenticated client that can submit MQINQ inquiry requests to a vulnerable IBM MQ instance.

Critical Impact
Successful exploitation compromises confidentiality, integrity, and availability of the IBM MQ queue manager and may lead to arbitrary code execution on the messaging broker host.

Affected Products

IBM MQ (versions listed in the vendor advisory)
Queue managers processing MQINQ inquiry requests
IBM MQ client-facing channels exposed to authenticated users

Discovery Timeline

2026-09-18 - CVE-2026-11725 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-11725

Vulnerability Analysis

The vulnerability resides in how IBM MQ parses and processes MQINQ (inquire) requests. MQINQ is a Message Queue Interface verb that clients use to query attributes of MQ objects such as queues, channels, and processes. During request handling, an arithmetic operation on attacker-controlled length or count fields overflows an integer boundary. The resulting undersized value is then used in subsequent memory operations, corrupting adjacent memory or bypassing size checks.

Because MQINQ is a routine administrative and application-level operation, the attack surface is exposed on any channel that accepts authenticated client connections. The flaw affects all three security properties of the queue manager process, meaning an attacker can leak in-process data, tamper with state, or terminate the service.

Root Cause

The root cause is an integer overflow [CWE-190] in the MQINQ request handler. The code performs arithmetic on untrusted size or selector-count fields without validating that the result fits within the destination integer type. The truncated value then drives buffer allocation or bounds checks, producing a mismatch between allocated memory and the data written into it.

Attack Vector

Exploitation requires network access to the IBM MQ listener and valid authentication credentials on a channel that permits MQINQ operations. An attacker crafts a malformed MQINQ request with selector counts or length fields chosen to trigger the overflow. The queue manager processes the request, and the corrupted memory operation either crashes the service or, if the attacker controls surrounding memory layout, redirects execution.

No user interaction is required, and the attack executes within a single request-response exchange. See the IBM Support advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-11725

Indicators of Compromise

Unexpected termination or restart of the amqzxma0, amqrmppa, or related IBM MQ queue manager processes
FDC (First Failure Data Capture) files in the MQ errors directory referencing MQINQ handling or memory faults
Anomalous MQINQ requests from authenticated clients containing unusually large selector counts
Core dumps generated by the queue manager coinciding with client MQINQ traffic

Detection Strategies

Enable MQ channel authentication records and audit logging to correlate MQINQ requests with source identities
Baseline normal MQINQ selector counts per application and alert on statistical outliers
Monitor queue manager error logs (AMQERR01.LOG) for MQRC_UNEXPECTED_ERROR and abend events tied to inquiry operations

Monitoring Recommendations

Forward IBM MQ error logs and FDC output to a centralized SIEM for correlation with authentication events
Track queue manager process uptime and alert on unplanned restarts
Monitor network traffic to MQ listener ports (default 1414) for abnormal request sizes from client channels

How to Mitigate CVE-2026-11725

Immediate Actions Required

Apply the IBM MQ security update referenced in the IBM Support advisory as soon as feasible
Inventory all IBM MQ queue managers and identify versions exposed to authenticated clients
Restrict MQ channel access to trusted networks and reduce the population of accounts that can open client connections

Patch Information

IBM has published remediation guidance on the IBM Support page for this advisory. Administrators should review the advisory for the specific fix pack, interim fix, or version upgrade that addresses the MQINQ integer overflow and apply it to every affected queue manager.

Workarounds

Tighten channel authentication records (CHLAUTH) to block untrusted client identifiers from opening MQI channels
Remove +inq authority from user groups that do not require MQINQ operations using setmqaut
Place IBM MQ listeners behind network segmentation so only known application hosts can reach the listener port
Enable TLS on client channels to prevent unauthenticated network peers from reaching the vulnerable code path

bash

# Configuration example: restrict MQINQ authority and block untrusted channels
runmqsc QM1 <<EOF
SET CHLAUTH('SYSTEM.DEF.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) ACTION(REPLACE)
SET CHLAUTH('APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.0.0.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
EOF

setmqaut -m QM1 -t qmgr -g appgroup -inq