A critical heap-based buffer overflow vulnerability in the IBM MQ C client for HPE NonStop could allow unauthenticated remote attackers to execute arbitrary code or crash affected systems.

This vulnerability is a heap-based buffer overflow (CWE-122) occurring when the MQ C client improperly validates responses from a queue manager during AMS policy data retrieval. An unauthenticated remote attacker can exploit this flaw by sending a crafted response to the client.

The potential for arbitrary code execution poses a severe risk to organizational data integrity and system confidentiality. Given the CVSS score of 8.1, this high-severity vulnerability could lead to total system compromise, resulting in significant operational downtime and the potential for unauthorized data access if exploited successfully.

Immediate Action: Upgrade to IBM MQ for HPE NonStop version 8.1.0.41 (CSU 8.1.0.41) as recommended by the vendor.

Proactive Monitoring: Review system and application logs for unusual crashes or unexpected process terminations related to the MQ C client.

Compensating Controls: Implement network segmentation to restrict communication between MQ clients and untrusted queue managers, and utilize intrusion detection systems to monitor for anomalous traffic patterns.

Public Exploit Available: No

Due to the potential for arbitrary code execution and the high CVSS severity rating, this vulnerability presents a significant risk to the integrity of the IBM MQ environment. Administrators should prioritize the deployment of the 8.1.0.41 update across all affected HPE NonStop systems immediately to ensure the buffer overflow condition is remediated.