Windows Message Queuing CVE-2026-33838

Exploitation requires that the Windows Message Queuing (MSMQ) feature is installed and running on the target host - MSMQ is not enabled by default, so hosts without the feature are not exploitable. The attacker must already be an authenticated local principal with at least low privileges (PR:L) and the ability to execute code or interact with the MSMQ service on the machine; there is no network-only path (AV:L) and no user interaction is required (UI:N). Limiting factors: local access and an existing account are mandatory, exploitation is not automatable per CISA SSVC, and only builds below the fixed versions listed in the MSRC/EUVD data are affected.

Signals are consistent and point to a moderate, patch-in-normal-cycle priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity, low-privilege attack with no user interaction and total impact, which matches the 'authorized attacker elevates privileges locally' description. EPSS is very low (0.04%, 14th percentile) and CISA SSVC records Exploitation: none and Automatable: no, so widespread or automated exploitation is not expected; however SSVC Technical Impact is 'total', aligning with the C/I/A:H rating. No KEV listing and no POC means no confirmed exploitation. One data conflict must be flagged: the intelligence Tags label this 'Information Disclosure', but the description, CWE-415, and the C:H/I:H/A:H vector clearly describe a memory-corruption elevation-of-privilege issue - treat this as EoP and consider the 'Information Disclosure' tag likely mis-categorized; verify against the MSRC advisory.

An attacker who already has a low-privileged foothold on a Windows host where MSMQ is installed (for example via a compromised standard user account or a limited service) sends crafted local requests to the Message Queuing service to trigger the double free and reclaim the freed allocation, corrupting service memory to run code as SYSTEM. Because AV:L/AC:L/PR:L/UI:N, no victim interaction is needed and complexity is low, though local access is a prerequisite. No public exploit code is identified at time of analysis, so this remains a plausible but not-yet-demonstrated chain.