{"id":"CVE-2026-10747","state":"PUBLISHED","title":"IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing","description":"IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.","publishedAt":"2026-09-18T15:55:43.394Z","updatedAt":"2026-09-21T12:47:23.571Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM MQ Appliance"],"affected":[{"vendor":"IBM","product":"MQ Appliance","versions":[{"version":"9.4 LTS","status":"affected","lessThanOrEqual":"9.4.0.0 to 9.4.0.25","versionType":"custom"},{"version":"9.4 CD","status":"affected","lessThanOrEqual":"9.4.1.0 to 9.4.5.2","versionType":"custom"},{"version":"10.0.0.0","status":"affected","lessThanOrEqual":"10.0.0.1 only","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:10.0.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:10.0.0.1:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7284690"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/10xxx/CVE-2026-10747.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-10747","state":"PUBLISHED","datePublished":"2026-09-18T15:55:43.394Z","dateUpdated":"2026-09-21T12:47:23.571Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-06-03T13:39:03.419Z"},"containers":{"cna":{"title":"IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing","descriptions":[{"lang":"en","value":"IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication."}],"affected":[{"vendor":"IBM","product":"MQ Appliance","versions":[{"version":"9.4 LTS","status":"affected","lessThanOrEqual":"9.4.0.0 to 9.4.0.25","versionType":"custom"},{"version":"9.4 CD","status":"affected","lessThanOrEqual":"9.4.1.0 to 9.4.5.2","versionType":"custom"},{"version":"10.0.0.0","status":"affected","lessThanOrEqual":"10.0.0.1 only","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:9.4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:10.0.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq_appliance:10.0.0.1:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7284690","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":10,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","lang":"en","description":"CWE-122 Heap-based Buffer Overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-09-18T15:55:43.394Z"},"solutions":[{"lang":"en","value":"This vulnerability is addressed under APAR DT472411\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\nIBM MQ Appliance version 9.4 LTS\nApply IBM MQ Appliance fix pack 9.4.0.26 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2003\nUpgrade to IBM MQ Appliance 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 9.4 CD - M2002\nApply  IBM MQ Appliance cumulative security update 9.4.5.3 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.\n\n\n\nIBM MQ Appliance version 10 LTS\nApply IBM MQ Appliance fix pack 10.0.0.5 https://www.ibm.com/support/fixcentral/swg/selectFixes , or later firmware.","supportingMedia":[{"type":"text/html","base64":false,"value":"

This vulnerability is addressed under APAR DT472411

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.4 LTS
Apply IBM MQ Appliance fix pack 9.4.0.26, or later firmware.

IBM MQ Appliance version 9.4 CD - M2003
Upgrade to IBM MQ Appliance 10.0.0.5, or later firmware.

IBM MQ Appliance version 9.4 CD - M2002
Apply IBM MQ Appliance cumulative security update 9.4.5.3, or later firmware.

IBM MQ Appliance version 10 LTS
Apply IBM MQ Appliance fix pack 10.0.0.5, or later firmware.

"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-10747","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-19T03:56:46.797549Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-21T12:47:23.571Z"}}]}}}