CVE-2026-11831: CWE-122 Heap-based Buffer Overflow in IBM MQ Operator

IBM MQ Operator contains a heap-based buffer overflow (CWE-122) vulnerability identified as CVE-2026-11831. This flaw arises from an out-of-bounds read when processing specially crafted client requests, which can lead to a limited denial of service and disclosure of limited process memory layout information. The vulnerability requires the attacker to be authenticated and does not involve user interaction. It affects a broad range of IBM MQ Operator versions, including multiple minor releases across versions 2.x, 3.x, 4.x, 9.x, and 10.x. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, reflecting network attack vector, low attack complexity, and limited confidentiality and availability impact.

An authenticated attacker can exploit this vulnerability to cause a limited denial of service condition and obtain very limited information about the process memory layout. There is no indication of integrity impact or full system compromise. The impact is therefore limited to partial service disruption and minor information disclosure.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to the IBM MQ Operator and monitor for unusual client requests that could trigger the vulnerability.