CVE-2026-10575

HighCVSS 8.8/10Last modified Sep 23, 2026

Description

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1057507.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 uCVE-2026-1057517.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 CVE-2026-1057523.1vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/rCVE-2026-1057536.5vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a mCVE-2026-1057546.5vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregatedCVE-2026-1057554.2vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerankCVE-2026-1057566.5vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cachCVE-2026-1057576.5vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scCVE-2026-1057585.3vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackendCVE-2026-1057597.5vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware recordCVE-2026-1057605.3vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs fieldCVE-2026-1057617.1Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/contro
CVE-2026-10575: High severity, CVSS 8.8 | Vulnix