CVE-2025-33013

moderate-risk

Published 2025-07-24

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release.

Do I need to act?

-

0.02% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

6

CVSS 6.2/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Affected Vendors

Ibm

References (1)

Vendor Advisory https://www.ibm.com/support/pages/node/7240431

47

/ 100

moderate-risk

Severity 20/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 27/34 · High