Medium severity · published Jul 24, 2025
CVE-2025-33013
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MQ Operator · Ibm
2.0.0 through 2.0.29; 3.2.0 through 3.2.13; 3.5.1 through 3.6.0; 3.3.0; 3.4.0; 3.4.1; +1 more · source: NVD
SM
Supplied MQ Advanced Container Images · Ibm
9.3.0.0; 9.3.0.0; 9.3.0.0; 9.3.0.1; 9.3.0.1; 9.3.0.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-33013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-33013
Vendor Advisory
https://www.ibm.com/support/pages/node/7240431
More from MQ Operator
9.8
CVE-2026-12665
IBM MQ Buffer Overflow
9.8
CVE-2025-36041
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through…
9.8
CVE-2024-39742
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability
8.8
CVE-2026-10572
IBM MQ Buffer Overflow
8.8
CVE-2026-10574
IBM MQ Buffer Overflow