CVE-2026-11831 IBM MQ Heap-based Buffer Overflow

Medium 5.4 Published 19 Oct 2026 Updated 20 Oct 2026

An authenticated attacker can cause a denial of service and leak limited memory layout information via an out-of-bounds read in IBM MQ.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-11831?

CVE-2026-11831 is a medium-severity memory corruption vulnerability in IBM MQ Advanced container images, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.

Weakness: CWE-122

Which versions are affected by CVE-2026-11831?

It affects 2 products.

Products include Ibm Mq Operator, Ibm Supplied Mq Advanced Container Images.

How do I fix CVE-2026-11831?

No fix has been published for CVE-2026-11831 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-11831 being exploited?

There is no known exploitation of CVE-2026-11831 in the wild and no public exploit code.

Sources

Also known as GHSA-wvhw-jq53-22mq.