CVE-2025-33013: IBM MQ Operator information disclosure

Published Jul 23, 2025
·
Updated

IBM MQ Container could disclose sensitive information to a local user due to improper clearing of heap memory before release.

Other sources

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release.

— MITRE

Affected Software

63 affected components
IBM MQ Operator LTS>=2.0.0<=2.0.29
IBM MQ Operator CD>=3.1.0<3.1.3
IBM MQ Operator SC2>=3.2.0<=3.2.13
IBM MQ Operator<=SC2: v3.2.0 - v3.2.13 CD:  v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.6.0 LTS: v2.0.0 - 2.0.29
IBM supplied MQ Advanced container images<=SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2
IBM MQ Operator>=2.0.0<=2.0.29
IBM MQ Operator>=3.2.0<=3.2.13
IBM MQ Operator>=3.5.1<=3.6.0
IBM MQ Operator=3.3.0
IBM MQ Operator=3.4.0
IBM MQ Operator=3.4.1
IBM MQ Operator=3.5.0
IBM supplied MQ Advanced container images=9.3.0.0-r1
IBM supplied MQ Advanced container images=9.3.0.0-r2
IBM supplied MQ Advanced container images=9.3.0.0-r3
IBM supplied MQ Advanced container images=9.3.0.1-r1
IBM supplied MQ Advanced container images=9.3.0.1-r2
IBM supplied MQ Advanced container images=9.3.0.1-r3
IBM supplied MQ Advanced container images=9.3.0.1-r4
IBM supplied MQ Advanced container images=9.3.0.3-r1
IBM supplied MQ Advanced container images=9.3.0.4-r1
IBM supplied MQ Advanced container images=9.3.0.4-r2
IBM supplied MQ Advanced container images=9.3.0.5-r1
IBM supplied MQ Advanced container images=9.3.0.5-r2
IBM supplied MQ Advanced container images=9.3.0.5-r3
IBM supplied MQ Advanced container images=9.3.0.6-r1
IBM supplied MQ Advanced container images=9.3.0.10-r1
IBM supplied MQ Advanced container images=9.3.0.10-r2
IBM supplied MQ Advanced container images=9.3.0.11-r1
IBM supplied MQ Advanced container images=9.3.0.11-r2
IBM supplied MQ Advanced container images=9.3.0.15-r1
IBM supplied MQ Advanced container images=9.3.0.16-r1
IBM supplied MQ Advanced container images=9.3.0.16-r2
IBM supplied MQ Advanced container images=9.3.0.17-r1
IBM supplied MQ Advanced container images=9.3.0.17-r2
IBM supplied MQ Advanced container images=9.3.0.17-r3
IBM supplied MQ Advanced container images=9.3.0.20-r1
IBM supplied MQ Advanced container images=9.3.0.20-r2
IBM supplied MQ Advanced container images=9.3.0.21-r1
IBM supplied MQ Advanced container images=9.3.0.21-r2
IBM supplied MQ Advanced container images=9.3.0.21-r3
IBM supplied MQ Advanced container images=9.3.0.25-r1
IBM supplied MQ Advanced container images=9.4.0.0-r1
IBM supplied MQ Advanced container images=9.4.0.0-r2
IBM supplied MQ Advanced container images=9.4.0.0-r3
IBM supplied MQ Advanced container images=9.4.0.5-r1
IBM supplied MQ Advanced container images=9.4.0.5-r2
IBM supplied MQ Advanced container images=9.4.0.6-r1
IBM supplied MQ Advanced container images=9.4.0.6-r2
IBM supplied MQ Advanced container images=9.4.0.7-r1
IBM supplied MQ Advanced container images=9.4.0.10-r1
IBM supplied MQ Advanced container images=9.4.0.10-r2
IBM supplied MQ Advanced container images=9.4.0.11-r1
IBM supplied MQ Advanced container images=9.4.0.11-r2
IBM supplied MQ Advanced container images=9.4.0.11-r3
IBM supplied MQ Advanced container images=9.4.1.0-r1
IBM supplied MQ Advanced container images=9.4.1.0-r2
IBM supplied MQ Advanced container images=9.4.1.1-r1
IBM supplied MQ Advanced container images=9.4.2.0-r1
IBM supplied MQ Advanced container images=9.4.2.0-r2
IBM supplied MQ Advanced container images=9.4.2.1-r1
IBM supplied MQ Advanced container images=9.4.2.1-r2
IBM supplied MQ Advanced container images=9.4.3.0-r1

Remediation

Information

Issues mentioned by this security bulletin are addressed in - IBM MQ Operator v3.6.1 CD release that included IBM supplied MQ Advanced 9.4.3.0-r2 container image. IBM MQ Operator v3.2.14 SC2 release that included IBM supplied MQ Advanced 9.4.0.12-r1 container image. IBM MQ Container 9.4.3.0-r2 release. IBM strongly recommends applying the latest container images. IBM MQ Operator v3.6.1 CD release details: ibm-mq-operator v3.6.1 icr.io icr.io/cpopen/ibm-mq-operator@sha256:b1bbebeb361e9e59311684da233c7d5978ffe17a78feb03eeb2411df9a0f5d03 ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-integration 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:534c801a22338398bfb61ae443eeb6ba84152f0fad5538e212eefab1498336ed ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5 IBM MQ Operator v3.2.14 SC2 release details: ibm-mq-operator v3.2.14 icr.io icr.io/cpopen/ibm-mq-operator@sha256:3979ba0bc28b6302f453633d3d238323c52679550760803d503ca51073c98cbf ibm-mqadvanced-server 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:222c1500565d08d6ab4dff9c7d550ce9e12909735e699882b79632ebe00dd61d ibm-mqadvanced-server-integration 9.4.0.12-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:762f4f5e04c682f9ce39d6e189999fb505e373a60791f5a91fc413e4a72be014 ibm-mqadvanced-server-dev 9.4.0.12-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:2d5fa97b1e7f4d3d27c9afa963876172dc634ac861e3a5c5cb1cbf1e81252e15 IBM MQ Container 9.4.3.0-r2 release details: ibm-mqadvanced-server 9.4.3.0-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:5bd01da84348f4ffb8b96427b6b8a4c471e63153f13e912315c3e7c9b3fffa8d ibm-mqadvanced-server-dev 9.4.3.0-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:c2166a034f620d7479741342255968fe4076e8ce0bf45f1d67705ff1635146d5

Event History

Jul 23, 2025
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jul 24, 2025
CVE Published
via MITRE·02:55 PM
Data Sourced
via MITRE·02:55 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-33013?

CVE-2025-33013 has been assessed to potentially allow sensitive information disclosure due to improper memory clearing.

2

How do I fix CVE-2025-33013?

To mitigate CVE-2025-33013, upgrade to the latest version of IBM MQ Operator that is not affected by the vulnerability.

3

Which versions are affected by CVE-2025-33013?

CVE-2025-33013 affects IBM MQ Operator LTS versions 2.0.0 through 2.0.29 and several versions of MQ Operator CD and SC2.

4

Could CVE-2025-33013 affect my local environment?

Yes, CVE-2025-33013 could potentially allow a local user to access sensitive information stored in heap memory.

5

Is there a known exploit for CVE-2025-33013?

As of now, there is no public information indicating that exploits for CVE-2025-33013 are actively being used in the wild.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203