IBM MQ 9.4.x-10.0.x Header Len Validation Info Leak/DoS
CVE-2026-12538 Published on November 4, 2026
IBM MQ Appliance is affected by an improper validation vulnerability
IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.
Vulnerability Analysis
CVE-2026-12538 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity, and a small impact on availability.
Weakness Type
What is a buffer underrun Vulnerability?
The software writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer. This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.
CVE-2026-12538 has been classified to as a buffer underrun vulnerability or weakness.
Products Associated with CVE-2026-12538
Want to know whenever a new CVE is published for IBM Mq Appliance? stack.watch will email you.
Affected Versions
IBM MQ Appliance:- Version 9.4.0.0, <= 9.4.0.26 is affected.
- Version 9.4.1.0, <= 9.4.5.3 is affected.
- Version 10.0.0.1, <= 10.0.0.5 is affected.