What is the CVSS score of CVE-2026-34329?

CVE-2026-34329 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Message Queuing are affected by CVE-2026-34329?

CVE-2026-34329 is a critical remote code execution vulnerability in Windows Message Queuing (MSMQ) affecting unauthenticated users on the same network segment, enabling arbitrary code execution with…. A patch is available.

How to fix or mitigate CVE-2026-34329?

Within 24 hours: Inventory all Windows systems with MSMQ service enabled across the organization; isolate or restrict network access to affected MSMQ systems from untrusted subnets if patching cannot be completed immediately. Within 7 days: Deploy Microsoft's May 2026 security update to all identified MSMQ-enabled systems; verify patch installation via Windows Update reporting or manual version verification. Within 30 days: Conduct network segmentation review to restrict MSMQ traffic to trusted administrative networks only; disable MSMQ service on systems where it is not operationally required.

Windows Message Queuing CVE-2026-34329

EUVD-2026-29588 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-12 microsoft

GHSA-8gp6-w6f8-h3c5

Heap Overflow Microsoft Buffer Overflow

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 18:32 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 8.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.

AnalysisAI

Heap-based buffer overflow in Windows Message Queuing (MSMQ) allows remote unauthenticated attackers on adjacent networks to execute arbitrary code with high impact to confidentiality, integrity, and availability across multiple Windows versions. Microsoft released patches via their May 2026 security update. The vulnerability requires adjacent network access (same subnet/VLAN) but no authentication, user interaction, or special configuration, making it exploitable against default Windows installations where MSMQ service is enabled. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis.

Technical ContextAI

Windows Message Queuing (MSMQ) is Microsoft's implementation of message queue middleware, enabling asynchronous communication between distributed applications through reliable message delivery. The vulnerability (CWE-122: Heap-based Buffer Overflow) occurs when MSMQ improperly validates message sizes or buffer boundaries during queue processing, allowing attackers to overflow heap memory structures. CPE data confirms impact across all modern Windows client (10 and 11) and server (2012+) platforms. MSMQ typically listens on network ports (TCP 1801, UDP 1801, RPC dynamic ports) for remote queue operations. The heap overflow suggests memory corruption in message parsing or queue management routines, where malformed MSMQ packets trigger unsafe memory operations that overwrite adjacent heap metadata or function pointers.

RemediationAI

Apply Microsoft's May 2026 security updates immediately for all systems with MSMQ installed, available through Windows Update, WSUS, or manual download from the Microsoft Update Catalog via https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34329. Organizations not requiring MSMQ functionality should disable or uninstall the Message Queuing feature entirely through Windows Features (Programs and Features > Turn Windows features on or off > Microsoft Message Queue Server) to eliminate attack surface-this is the most effective long-term mitigation with no functional impact if MSMQ is unused. For systems requiring MSMQ where patching cannot be immediately deployed, implement network segmentation to restrict MSMQ network access to only trusted systems via firewall rules blocking TCP/UDP port 1801 and RPC dynamic ports from untrusted network segments-note this breaks MSMQ functionality for remote clients but prevents adjacent network exploitation. Monitor MSMQ service logs (Application and Services Logs > Microsoft > Windows > MSMQ) for unexpected connection attempts or service crashes indicating exploitation attempts.