Microsoft Message Queuing CVE-2026-50439

The exploitable prerequisite is that the optional Microsoft Message Queuing (MSMQ) feature is installed and its Queue Manager service is running and network-reachable - typically TCP port 1801 exposed to the attacker. Given AV:N/AC:L/PR:N/UI:N, once MSMQ is reachable there are no authentication, privilege, or user-interaction requirements against a default-configured MSMQ service. The primary limiting factor is that MSMQ is NOT installed by default on Windows; only hosts where an administrator or application has explicitly enabled the feature are exposed, and firewall filtering of the MSMQ port further constrains reachability. Reliability is also limited by the need to win a use-after-free/heap-grooming race, consistent with SSVC 'Automatable: no.'

The signals are partially conflicting and warrant nuance. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 (Critical) and describes trivial remote, unauthenticated, no-interaction exploitation with total technical impact, which CISA SSVC corroborates as 'Technical Impact: total.' However, SSVC also records 'Exploitation: none' and 'Automatable: no,' and the EPSS score is low (0.52%, 41st percentile), indicating no known exploitation and no evidence of mass, automatable scanning yet. This is a classic high-CVSS, network-facing memory-corruption bug that is a genuine patching priority - especially given MSMQ's history of being targeted (e.g., the 'QueueJumper' family) - but the absence of a public POC and low EPSS suggest exploitation would require non-trivial exploit development rather than being imminent commodity attack. The key mitigating real-world factor is that MSMQ is an optional feature and is not enabled by default, so exposure is limited to hosts that have installed and exposed the service.

An attacker who can reach an MSMQ-enabled Windows host on TCP/1801 sends a crafted sequence of queue-manager messages that triggers the use-after-free, grooms the heap to control the freed object, and hijacks execution to run code in the context of the MSMQ service. No credentials or user interaction are required per the CVSS vector. No public exploit has been identified at time of analysis, so a successful attack currently presupposes attacker-developed exploitation of the memory-corruption primitive.