Loading vulnerability…
IBM MQ XA Transaction Identifier Stack Buffer Overflow
CVE-2026-11375 is a stack-based buffer overflow in IBM MQ's processing of XA transaction identifiers. Insufficient bounds checking of a transaction identifier can allow an authenticated remote attacker to supply crafted input that overwrites stack memory, resulting in denial of service or potential arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can terminate or destabilize the affected IBM MQ service, causing denial of service. Depending on the overwritten memory and execution context, the flaw may also permit arbitrary code execution with the privileges of the affected IBM MQ process, compromising confidentiality, integrity, and availability.
Patch, then assume compromise.
Apply IBM MQ fixes by updating IBM MQ 9.1 LTS to 9.1.0.38 or later, 9.2 LTS to 9.2.0.44 or later, 9.3 LTS to 9.3.0.42 or later, or 9.4 LTS to 9.4.0.26 or later. Users of IBM MQ Continuous Delivery releases 9.3 CD, 9.4 CD, and 10.0.0.0 should upgrade to IBM MQ 10.0.0.5 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.