Windows Message Queuing CVE-2026-100202

Exploitation requires that the Windows Message Queuing (MSMQ) feature is installed and running - it is an optional Windows component that is NOT enabled by default - and that the MSMQ service is reachable on its listener (TCP port 1801, with related UDP 3527 and TCP 2101/2103/2105). Where MSMQ is enabled and that port is exposed to the attacker, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed. The primary LIMITING factor is therefore deployment: hosts without the MSMQ feature or with TCP 1801 firewalled are not exploitable, which substantially reduces the realistic attack surface despite the 9.8 score.

Multiple signals point to genuine high priority, but with an important caveat about exploitability conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a textbook critical remote code execution primitive: network-reachable, low complexity, no privileges, no user interaction, with full C:H/I:H/A:H impact - hence the 9.8 base score. CWE-416 (use-after-free) in a network-facing service is historically a reliable path to RCE (cf. prior MSMQ flaws such as CVE-2023-21554 'QueueJumper'). However, EPSS is not provided, the vulnerability is NOT in CISA KEV, and no POC is referenced, so the exploitation status is 'no public exploit identified at time of analysis' - the 9.8 reflects potential impact, not observed in-the-wild activity. The single intelligence source is the Microsoft MSRC advisory itself (no NVD enrichment, no independent analysis), so there is no corroborating exploitation telemetry. The most important mitigating signal is NOT in the CVSS vector: Windows Message Queuing (MSMQ) is an optional Windows component disabled by default, which sharply narrows the real-world attack surface relative to what AV:N/PR:N alone implies. Net: treat as a high-priority patch for any host where MSMQ is enabled and TCP 1801 is exposed, but the absence of KEV/POC/EPSS data means there is no evidence of active or widespread exploitation yet.

A remote, unauthenticated attacker sends a specially crafted Message Queuing packet to the MSMQ service listening on TCP port 1801, triggering a use-after-free in the Queue Manager that corrupts heap memory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are needed, and successful exploitation yields code execution in the context of the MSMQ service (frequently SYSTEM). No public exploit code is referenced at time of analysis, so this scenario is inferred from the CVSS vector and CWE-416 class rather than a demonstrated POC.