IBM MQ contains a heap-based buffer overflow vulnerability (CWE-122) triggered when processing MQPUT operations with malformed distribution headers. This flaw allows an authenticated attacker to cause denial of service or potentially escalate privileges. The affected versions are 9.1.0.0, 9.2.0.0, 9.3.0.0, 9.4.0.0, and 10.0.0.0. The vulnerability is publicly known and assigned CVE-2026-10575 with a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. No patch or vendor advisory information is provided in the input data.

Successful exploitation could lead to denial of service or privilege escalation on affected IBM MQ installations. The attacker must be authenticated to exploit the vulnerability. The impact affects confidentiality, integrity, and availability of the system as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to IBM MQ to trusted authenticated users only and monitor for suspicious MQPUT operations with malformed headers.