Windows Message Queuing CVE-2025-62455

Requires the Windows Message Queuing (MSMQ) feature to be installed and enabled on the target host - an optional Windows component that is NOT present in default installations. The attacker must already have local, low-privileged authenticated access (PR:L, AV:L) to run the exploit; no user interaction is needed (UI:N). It is not remotely exploitable over the network on its own and functions as a post-foothold privilege-escalation step. Affected platforms are Windows 10 (1607/1809/21H2/22H2) and Windows Server 2008/2008 R2/2012/2016/2019.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local elevation-of-privilege flaw: an already-authenticated low-privileged user runs code that abuses improper input validation (CWE-20) in Windows Message Queuing (MSMQ) to gain full SYSTEM-level control (complete confidentiality, integrity, and availability impact). Because the attack vector is local and requires existing low-privilege access (PR:L), it is not remotely triggerable and is not a mass-exploitation candidate - it is a second-stage/post-compromise capability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or automatable weaponization; per the exploitation-status rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. A conflicting signal to note: the input Tags label this 'Information Disclosure,' which contradicts the description and CVSS vector - this is an elevation-of-privilege issue (I:H/A:H, not confidentiality-only), so the tag is mislabeled. The real limiting factor is that MSMQ is an optional Windows component not installed by default, which substantially narrows the exposed population despite Windows itself being ubiquitous.

An attacker who already has a low-privileged foothold on a Windows host where the MSMQ feature is installed (e.g., a standard user account or a compromised low-privilege service) sends crafted input to the Message Queuing service that fails input validation, corrupting execution to run attacker code with SYSTEM privileges. This turns a limited foothold into full host compromise. No public exploit code was identified at the time of analysis, and no user interaction is required.