CVE-2026-11828: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in IBM MQ Operator

This vulnerability in IBM MQ Operator arises from improper validation of queue name length values, leading to a buffer copy without checking the size of the input (CWE-120). An attacker with control over the queue manager or man-in-the-middle access on unencrypted channels can exploit this flaw to cause a denial of service in client applications that consume messages asynchronously. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service conditions in client applications consuming messages asynchronously. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires either queue manager control or man-in-the-middle access on unencrypted channels, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should ensure secure channel configurations to prevent man-in-the-middle attacks and monitor for vendor updates regarding patches.