IBM MQ contains a heap-based buffer overflow vulnerability (CWE-122) identified as CVE-2026-11375. This flaw occurs during the processing of XA transaction identifiers, where a stack buffer overflow can be triggered. An authenticated attacker could exploit this vulnerability to cause denial of service or potentially execute arbitrary code on the affected system. The vulnerability affects IBM MQ versions 9.1.0.0, 9.2.0.0, 9.3.0.0, 9.4.0.0, and 10.0.0.0. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to denial of service or arbitrary code execution, compromising system confidentiality, integrity, and availability. The attacker must be authenticated to exploit this vulnerability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor IBM's official channels for updates and apply any official fixes once available. In the meantime, restrict access to IBM MQ to trusted authenticated users only.