CVE-2026-11376

HighCVSS 8.8/10Last modified Nov 12, 2026

Description

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2026
Last modified
Nov 12, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1137608.8Heap-based buffer overflow in Windows XWizard Framework allows an authorized attacker to elevate privileges locally.CVE-2026-1137617.0Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileCVE-2026-1137627.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1137636.3Use of a broken or risky cryptographic algorithm in Windows DPAPI (Data Protection Application Programming Interface) allows an authorized aCVE-2026-1137644.7Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to disclose information locCVE-2026-1137657.8Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.CVE-2026-1137663.3Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.CVE-2026-1137677.8Inclusion of functionality from untrusted control sphere in Windows COM+ Event System Service allows an authorized attacker to elevate priviCVE-2026-1137687.5Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network.CVE-2026-1137697.0Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.CVE-2026-1137707.0Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1137715.5Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-11376: High severity, CVSS 8.8 | Vulnix