CVE-2026-12665 is a stack-based buffer overflow in how IBM MQ parses TLS certificate distinguished names during channel connection setup, and NVD's own analysis scores it 9.8 critical because a remote, unauthenticated attacker who can present a malformed certificate to an MQ channel can potentially execute arbitrary code on the queue manager.
Vulnerability summary
9.8
Critical
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-19
Published
Vulnerability ID: CVE-2026-12665 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| IBM MQ Operator | cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:* | LTS stream 2.0.0 through 2.0.29; SC2 stream 3.2.0 through 3.2.29; CD stream 3.3.0 through 4.0.4 (fixed in 3.2.30 SC2, 4.0.5 SC2 and 4.1.0 CD) |
| IBM MQ Advanced container images | cpe:2.3:a:ibm:supplied_mq_advanced_container_images:*:*:*:*:*:*:*:* | LTS, SC2 and CD container image builds from 9.3.0.0 through 10.0.0.5-r1; fixed by updating to the container images shipped with Operator 3.2.30 SC2, 4.0.5 SC2 or 4.1.0 CD |
What this means
CVE-2026-12665 is a stack-based buffer overflow (CWE-121) in IBM MQ. During establishment of a channel connection, MQ processes the distinguished name (DN) fields of a presented TLS certificate; a certificate with a malformed DN can overflow a fixed-size stack buffer, and IBM's own description states this "could allow a remote attacker to execute arbitrary code" (NVD).
NVD performed its own CNA analysis and assigned a CVSS v3.1 Primary score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction needed, full impact to confidentiality, integrity and availability. This differs from IBM's own CNA (Secondary) score of 8.1, which assumes higher attack complexity; the critical rating used here is the NVD Primary metric (NVD).
IBM's security bulletin (published 2026-10-15, covering this and 46 other CVEs affecting MQ Operator and Queue Manager container images) lists CVE-2026-12665 as affecting the MQ Operator across its LTS (2.0.0-2.0.29), SC2 (3.2.0-3.2.29) and CD (3.3.0-4.0.4) release streams, plus the corresponding MQ Advanced container images, with no workaround identified; IBM's remediation is to update to MQ Operator v3.2.30 (SC2), v4.0.5 (SC2) or v4.1.0 (CD), which ship the patched container images (IBM Security Bulletin).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00315 (24.5th percentile), consistent with a very recently disclosed vulnerability that has not yet seen observed exploitation activity (FIRST EPSS). It is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Because MQ channels are frequently exposed to partner networks or the internet for B2B messaging, and because a successful exploit could lead to full compromise of the queue manager host, organizations running affected MQ Operator or container image versions with TLS-enabled channels should prioritize updating to the fixed releases.
Evidence
- Stack-based buffer overflow in IBM MQ's processing of TLS certificate distinguished names during channel connection establishment, which could allow a remote attacker to execute arbitrary code. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; IBM's own CNA submission scores it 8.1 (Secondary). — NVD
- Affects IBM MQ Operator LTS 2.0.0-2.0.29, SC2 3.2.0-3.2.29, CD 3.3.0-4.0.4, and corresponding MQ Advanced container images; no workaround; fixed in Operator v3.2.30 SC2, v4.0.5 SC2 and v4.1.0 CD. — IBM Security Bulletin
- EPSS score is 0.00315 (24.5th percentile) as of 2026-10-30; not listed in CISA KEV. — FIRST EPSS
