## Summary
IBM MQ .NET Client contains a heap buffer overflow (CWE-787) in its asynchronous message receive handler that can be triggered by a malicious queue manager or via a man-in-the-middle attack. The issue may cause denial of service and potentially arbitrary code execution in the client.
## Technical Details
- Vulnerability type: heap buffer overflow in the IBM MQ .NET client's asynchronous message receive handler.
- Trigger conditions (as described by IBM):
- Receiving messages from a malicious queue manager, or
- Receiving messages through a man-in-the-middle attack.
- Security impact: out-of-bounds write leading to DoS and potentially arbitrary code execution in the client.
- CVSS (as provided): 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
## Affected
- IBM MQ .NET messaging installable component.
- IBM MQ versions:
- 9.1.0.0 to 9.1.0.37 (LTS)
- 9.2.0.0 to 9.2.0.43 (LTS)
- 9.3.0.0 to 9.3.0.41 (LTS)
- 9.3.0.0 to 9.3.5.1 (CD)
- 9.4.0.0 to 9.4.0.25 (LTS)
- 9.4.0.0 to 9.4.5.1 (CD)
- 10.0.0.0
## Impact
- Denial of service in the IBM MQ .NET client when processing crafted messages.
- Potential arbitrary code execution in the client context.
## Mitigation
1. Apply IBM’s recommended remediation/fixes for CVE-2026-11728 to the affected IBM MQ .NET messaging component.
2. If you cannot immediately patch, reduce exposure to untrusted queue managers and prevent man-in-the-middle conditions (e.g., ensure secure network paths and transport protections), since IBM notes both delivery paths as triggers.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787