Out-of-bounds read in OpenJ9 - CVE-2026-6918

Vulnerability identifier: #VU130954

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-6918

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in Message::deserialize() and MessageBuffer::readData() when processing a crafted TCP message containing an attacker-controlled DataDescriptor._size value. A remote attacker can send a specially crafted TCP message to cause a denial of service.

The issue occurs before protocol-level validation, and no authentication, encryption, or valid JIT compilation request is required. Deployments running without TLS client authentication are affected by default.

OpenJ9
IBM Sterling Connect:Direct FTP+
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling Connect:Direct for UNIX
SPSS Statistics
IBM OpenPages with Watson
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
IBM supplied MQ Advanced container images
DB2 Query Management Facility
Data Product Hub
IBM Sterling Connect:Direct for Microsoft Windows
IBM MQ Appliance
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for x86_64
java-21-ibm-semeru-certified-jdk (Red Hat package)

Install security update from vendor's website.

OpenJ9 - update to 0.59.0
IBM Sterling Connect:Direct FTP+ - update to 1.3.0.5
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
Data Product Hub - addressed in versions 5.3.1 Patch 7, 5.4.0
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.3.0.6.62, 6.4.0.4.35
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.3.0.7.iFix015, 6.4.0.5.iFix020
IBM MQ Appliance - addressed in versions 9.4.0.25, 9.4.5.2
java-21-ibm-semeru-certified-jdk (Red Hat package) - addressed in versions 21.0.11.0.10-1.el10_0, 21.0.11.0.10-2.el10_1
SPSS Statistics - addressed in versions 27.0.1.0 IF036, 28.0.1.1 IF018, 29.0.2.0 IF019, 30.0.0.0 IF015, 31.0.2.0 IF007

• https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-q393-vr4c-969r
• https://github.com/advisories/GHSA-q393-vr4c-969r

• Remote denial of service in Eclipse OpenJ9
• Multiple vulnerabilities in IBM OpenPages
• Red Hat Enterprise Linux 10 update for java-21-ibm-semeru-certified-jdk
• Multiple vulnerabilities in IBM Db2 Query Management Facility
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM SPSS Statistics
• Multiple vulnerabilities in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in IBM MQ Appliance
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in IBM Sterling Connect:Direct FTP+