Loading vulnerability…
IBM MQ Distribution List Processing Integer Overflow
CVE-2026-11378 is an integer overflow vulnerability in IBM MQ distribution-list processing. An authenticated attacker can remotely trigger the overflow, resulting in denial of service and potentially arbitrary code execution. The reported CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause IBM MQ service disruption. It may also permit arbitrary code execution in the context of the affected IBM MQ process, with potential high impacts to confidentiality, integrity, and availability.
Patch, then assume compromise.
Apply IBM MQ fixes by updating to IBM MQ 9.1.0.38, 9.2.0.44, 9.3.0.42, or 9.4.0.26 for the respective LTS release. Users of IBM MQ 9.3 Continuous Delivery, 9.4 Continuous Delivery, and 10.0.0.0 should upgrade to version 10.0.0.5.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.