CVE-2026-11728: IBM MQ Buffer Overflow Vulnerability

CVE-2026-11728 Overview

CVE-2026-11728 is a heap buffer overflow [CWE-787] in the IBM MQ client. The flaw affects IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS and 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS and 9.4.5.1 CD, and 10.0.0.0. A remote attacker can trigger a denial of service or potentially execute arbitrary code on the client. Exploitation occurs when the client receives crafted messages from a malicious queue manager or through a man-in-the-middle (MITM) position on the network path.

Critical Impact
Attackers who control a queue manager or intercept client traffic can crash IBM MQ clients or execute code in the client process context.

Affected Products

IBM MQ 9.1.0.0 through 9.1.0.37 LTS and 9.2.0.0 through 9.2.0.43 LTS
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, and 9.4.0.0 through 9.4.5.1 CD
IBM MQ 10.0.0.0

Discovery Timeline

2026-09-15 - CVE-2026-11728 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-11728

Vulnerability Analysis

The vulnerability is an out-of-bounds write on the heap within IBM MQ client message-handling logic. When the client parses inbound messages from a queue manager, insufficient boundary validation allows attacker-controlled data to overflow an allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, producing either a process crash or a controllable memory-write primitive.

Exploitation requires the client to receive a crafted message. This condition is satisfied either by a malicious or compromised queue manager, or by an attacker occupying a MITM position between a legitimate queue manager and the client. Because IBM MQ clients are commonly embedded in application servers and middleware bridges, a successful exploit can pivot into business-critical processes.

The CWE-787 classification aligns with the reported heap buffer overflow behavior. The EPSS estimate places CVE-2026-11728 in the mid range of predicted exploitation likelihood, and no public proof-of-concept has been observed at the time of publication.

Root Cause

The root cause is missing or incorrect length validation during deserialization of message data received by the MQ client library. Attacker-controlled fields exceed the size of the destination heap buffer, resulting in an out-of-bounds write.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction on the client. Two exploitation paths exist: a hostile queue manager returning malicious payloads to a connecting client, or a network attacker tampering with MQ traffic in transit when TLS mutual authentication is not enforced.

No verified public exploit code is available. See the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2026-11728

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption errors in processes hosting the IBM MQ client library (libmqic, amqrmppa, or embedded application binaries).
MQ client connections to queue manager endpoints outside of documented, approved infrastructure.
TLS handshake anomalies or certificate mismatches on MQ listener ports (typically TCP 1414).

Detection Strategies

Inventory IBM MQ client installations and correlate installed versions against the affected version ranges listed by IBM.
Alert on MQ client processes spawning unexpected child processes, loading unusual modules, or writing to non-standard file paths.
Monitor MQ error logs (AMQERR01.LOG) for FDC entries, protocol errors, or repeated abnormal disconnects that may indicate exploit attempts.

Monitoring Recommendations

Capture and retain network flow metadata for MQ channels to support retrospective investigation of MITM activity.
Ingest MQ client and queue manager logs into a centralized data lake for correlation with endpoint telemetry.
Track outbound connections from application servers to any queue manager address that was not previously baselined.

How to Mitigate CVE-2026-11728

Immediate Actions Required

Identify all systems running affected IBM MQ client versions, including embedded clients bundled with third-party applications.
Apply the IBM-provided fix pack or interim fix referenced in the vendor advisory as soon as feasible.
Enforce TLS with mutual authentication on all MQ channels to prevent MITM injection of crafted messages.

Patch Information

IBM has published remediation guidance and fix availability on the IBM Support Page. Administrators should upgrade to a fixed release above the affected ranges for each supported LTS and CD stream.

Workarounds

Restrict MQ client outbound connectivity to a strict allowlist of trusted queue manager endpoints.
Require certificate-based mutual TLS (SSLCIPH with a strong cipher and SSLPEER pinning) on client channels to block untrusted queue managers.
Segment application servers running MQ clients from untrusted networks and remove direct internet exposure to MQ ports.

bash

# Configuration example: enforce TLS and peer validation on an MQ client channel (runmqsc)
ALTER CHANNEL(CLIENT.TLS) CHLTYPE(CLNTCONN) +
  SSLCIPH(ANY_TLS13) +
  SSLPEER('CN=mq-prod-qm.example.com,O=Example Corp') +
  CERTLABL('client-cert-label')