IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a heap buffer overflow vulnerability (CWE-787) in the client component. This occurs when receiving messages from a malicious queue manager or during a man-in-the-middle attack, allowing a remote attacker to cause denial of service or potentially execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required.

A remote attacker can exploit this vulnerability to cause a denial of service or potentially execute arbitrary code on the client side of IBM MQ. This could lead to full compromise of the affected client system, impacting confidentiality, integrity, and availability of the system and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Until a patch is available, avoid connecting clients to untrusted queue managers or networks where man-in-the-middle attacks are possible.