CVE-2026-11378

IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40, C client, could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

IBM MQ contains a stack buffer overflow when processing XA transaction identifiers. An authenticated attacker could exploit this to cause a denial of service or potentially execute arbitrary code.

IBM MQ improperly validates cluster command message lengths. An authenticated attacker with cluster access could cause a denial of service or potentially execute arbitrary code.

IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed distribution headers. An authenticated attacker could cause a denial of service or potentially escalate privileges.

IBM MQ contains a buffer overflow when processing malformed compressed data on channels configured with compression enabled. A remote attacker could cause a denial of service or execute arbitrary code.