{"id":"CVE-2026-12665","published":"2026-10-19T17:17:18Z","modified":"2026-10-23T17:21:42Z","title":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS…","vendor":"IBM","product":"MQ Operator","tier":"core","eol":null,"description":{"text":"IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a stack-based buffer overflow in the IBM MQ Operator product, triggered when it processes TLS certificates containing malformed distinguished names during channel connection establishment. An attacker can exploit it over the network to execute arbitrary code, with no privileges or user interaction required, by presenting such a certificate during channel setup.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:04Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00315,"percentile":0.24477,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":5,"pulses":[{"name":"Known_Cve | Oct 28, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae0ba88997d8920e9952075","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adb7414397c3ad4799aa4ce","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad8d34cb141a6cceeba88be","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7292667","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-104465","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104465","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12665","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":4.9,"detail":"percentile 0.2448"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}