EUVD-2026-44054
GHSA-pc98-56qf-54j9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing MSMQ service reachable without auth or interaction (AV:N/AC:L/PR:N/UI:N); use-after-free yields code execution with total system impact (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. A use-after-free (CWE-416) in the queue manager lets a remote, unauthenticated attacker who can reach the MSMQ service execute arbitrary code with total impact to confidentiality, integrity, and availability. Microsoft has released patches; there is no public exploit identified at time of analysis and the EPSS probability is modest at 0.52%.
Technical ContextAI
MSMQ is an optional Windows messaging component that provides guaranteed, asynchronous message delivery between distributed applications, listening by default on TCP/1801 (with additional RPC and multicast ports) when the feature is installed. The vulnerable code lives in the Queue Manager (mqqm/mqsvc), the core service that receives, routes, and stores messages. The root cause is a use-after-free (CWE-416): the Queue Manager references heap memory after it has been freed, and by controlling the reallocated contents an attacker can corrupt object state and redirect execution. Because the flaw is in the network-facing message-parsing/queue-handling path, a single crafted packet to the MSMQ port can reach it. The CPE set spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations.
RemediationAI
Apply Microsoft's security update for CVE-2026-50439 (Vendor-released patch: available per MSRC advisory) to reach at least the fixed builds for each release - for example Windows 11 24H2 10.0.26100.8875, Windows Server 2022 10.0.20348.5386, Windows Server 2025 10.0.26100.33158, Windows Server 2019 10.0.17763.9020, and Windows Server 2012 R2 6.3.9600.23291; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50439 for the exact build per SKU. Where patching cannot be immediate, the most effective compensating control is to determine whether MSMQ is actually needed: if not, disable or uninstall the Message Queuing Windows feature entirely, which removes the attack surface but breaks any application relying on MSMQ messaging. If MSMQ must remain, block inbound TCP/1801 (and related MSMQ RPC/multicast ports 2101/2103/2105/3527/1801) at the host and perimeter firewall and restrict access to only trusted queue peers via IP allow-listing; the trade-off is that legitimate remote queue clients outside the allow-list will lose connectivity. Verify no MSMQ port is exposed to the internet.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today