{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12538","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","state":"PUBLISHED","assignerShortName":"ibm","dateReserved":"2026-06-17T15:22:07.491Z","datePublished":"2026-11-04T20:25:41.490Z","dateUpdated":"2026-11-04T20:25:41.490Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-11-04T20:25:41.490Z"},"title":"IBM MQ Appliance is affected by an improper validation vulnerability","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-124","description":"CWE-124 Buffer Underwrite ('Buffer Underflow')","type":"CWE"}]}],"affected":[{"vendor":"IBM","product":"MQ Appliance","versions":[{"status":"affected","version":"9.4.0.0","lessThanOrEqual":"9.4.0.26","versionType":"semver"},{"status":"affected","version":"9.4.1.0","lessThanOrEqual":"9.4.5.3","versionType":"semver"},{"status":"affected","version":"10.0.0.1","lessThanOrEqual":"10.0.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.","supportingMedia":[{"type":"text/html","base64":false,"value":"

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields.

"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293035","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW","baseSeverity":"MEDIUM","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"}}],"solutions":[{"lang":"en","value":"This vulnerability is addressed under APAR DT500605.\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\nIBM MQ Appliance version 9.4 LTS\nApply IBM MQ Appliance fix pack 9.4.0.30 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2003\nUpgrade to IBM MQ Appliance 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2002\nApply IBM MQ Appliance cumulative security update 9.4.5.4 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 10 LTS\nApply IBM MQ Appliance cumulative security update 10.0.0.6 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.","supportingMedia":[{"type":"text/html","base64":false,"value":"

This vulnerability is addressed under APAR DT500605.

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.4 LTS
Apply IBM MQ Appliance fix pack 9.4.0.30, or later firmware.

IBM MQ Appliance version 9.4 CD - M2003
Upgrade to IBM MQ Appliance 10.0.0.6, or later firmware.

IBM MQ Appliance version 9.4 CD - M2002
Apply IBM MQ Appliance cumulative security update 9.4.5.4, or later firmware.

IBM MQ Appliance version 10 LTS
Apply IBM MQ Appliance cumulative security update 10.0.0.6, or later firmware.

"}]}]}}}