CVE-2026-12150

IBM MQ contains a buffer overflow (CWE-121) in its TLS certificate processing path caused by improper validation of deeply nested certificate data. A remote attacker who already holds a trusted TLS client certificate can present a maliciously crafted certificate during the mutual-TLS handshake to crash the queue manager (denial of service) and potentially read or alter memory contents, reflected in the CVSS 3.1 base score of 7.0 (high) with C:L/I:L/A:H and high attack complexity. All supported IBM MQ streams are affected, spanning 9.1 through 9.4 LTS and CD releases plus 10.0.0.0. The trusted-certificate prerequisite narrows the attacker pool to holders of valid client credentials, compromised clients, or rogue insiders, but messaging backbones that fail can take dependent applications down with them. No public proof of concept exists and the flaw is not in CISA's KEV catalog, so no exploitation is currently known.

What to do: Apply the fixed refresh or fix pack IBM specifies in its advisory for your stream (9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD, and 10.0), prioritizing queue managers that accept client certificates from broad or externally managed CAs. Tighten mutual-TLS trust stores so only tightly controlled CAs can issue usable client certificates, and revoke unused client certificates to shrink the attacker pool. Review channel and error logs for unexplained queue-manager crashes or handshake failures from otherwise authenticated clients, which would be the strongest indicator of attempted exploitation.