CVE-2026-12665 (CVSS 8.1): IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certif

The CVE record published by ThreatInt says the flaw, CVE-2026-12665, is a stack buffer overflow that occurs when processing TLS certificates with malformed distinguished names during channel connection establishment[1]. According to the same record, IBM assigned it a HIGH: 8.1[1] CVSS score, and it was Published 2026-10-19[1].Threat Radar's listing reports that the CVSS vector gives the attack a network vector and Attack Complexity · High · Privileges Required · None · User Interaction · None[2]. VulDB takes a stronger view: it says it has been classified as very critical[3] and that the exploitation doesn't need any form of authentication.[3]Strix reports that the score comes from the IBM advisory and that NVD analysis pending.[4]According to TheHackerWire, no public exploit code has been confirmed for CVE-2026-12665 at this time[5]. The outlet says the flaw is not recorded in the CISA Known Exploited Vulnerabilities (KEV) catalog[5].Hol reports that IBM's bulletin lists fixes in IBM MQ Operator v4.1.0[6], IBM MQ Operator v4.0.5[6] and IBM MQ Operator v3.2.30[6], among other releases. According to Hol, IBM strongly recommends applying the latest container images.[6]Strix's database also lists other IBM MQ flaws, including CVE-2026-12666, which it rated 8.1[4].