Medium severity · published Oct 19, 2026
CVE-2026-12669
IBM MQ Out-of-bounds Read
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MQ Advanced container images · IBM
9.4.0.6-r1 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2; 9.4.0.6-r2; 9.4.0.7-r1; 9.4.0.10-r1; 9.4.0.10-r2; 9.4.0.11-r1; +34 more · source: vendor
MO
MQ Operator · IBM
3.2.0 through 3.2.29; 3.3.0 before 3.4.0; 3.4.1; 3.5.0; 3.5.1 through 3.5.3; 3.6.0 through 3.6.4; +12 more · source: vendor, NVD
SM
Supplied MQ Advanced Container Images · Ibm
9.4.1.0; 9.4.1.0; 9.4.1.1; 9.4.2.0; 9.4.2.0; 9.4.2.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12669
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12669
Vendor Advisory
https://www.ibm.com/support/pages/node/7292667
More from MQ Advanced container images
9.8
CVE-2026-12665
IBM MQ Buffer Overflow
8.8
CVE-2026-10572
IBM MQ Buffer Overflow
8.8
CVE-2026-10574
IBM MQ Buffer Overflow
8.8
CVE-2026-10743
IBM MQ Race Condition
8.8
CVE-2026-12148
IBM MQ Deserialization of Untrusted Data