EUVD-2026-44068
GHSA-9fc2-hg5p-q5q3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network RCE with no user interaction against a network-listening service yields AV:N/AC:L/PR:N/UI:N; memory-corruption code execution gives full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary code over the network by corrupting heap memory. The flaw (CWE-122) carries a CVSS 9.8 and affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis, but the network-reachable, no-interaction, no-privilege profile of prior MSMQ bugs (e.g. the 'QueueJumper' class) makes this a top-priority patch. Microsoft has released a fix.
Technical ContextAI
Message Queuing (MSMQ) is an optional Windows middleware component that provides asynchronous, store-and-forward messaging between applications, typically listening on TCP/UDP port 1801 (with additional RPC ports) when enabled. When present, the service (mqsvc.exe) parses attacker-controlled message packets, and CWE-122 (heap-based buffer overflow) indicates the vulnerable code writes past the bounds of a heap-allocated buffer while processing a malformed message - corrupting adjacent heap metadata or objects and enabling control-flow hijacking. The affected CPEs span Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025 including Server Core installations, confirming the flaw is in the shared MSMQ implementation common to both desktop and server editions.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-50447 for your specific OS build via Windows Update or WSUS/SCCM; consult the per-SKU fixed build numbers in the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50447 to confirm the exact patched version for each affected system. As a primary compensating control where patching must be delayed, disable the Message Queuing (MSMQ) Windows feature on hosts that do not require it - this removes the attack surface entirely but breaks any application relying on MSMQ messaging. If MSMQ must remain enabled, restrict access by blocking inbound TCP port 1801 (and related MSMQ RPC ports) at the host and network firewall so only trusted, segmented management or application hosts can reach the service; the trade-off is that legitimate remote queue clients on blocked networks will lose connectivity. Prioritize internet-facing and DMZ hosts first.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today