Windows Message Queuing CVE-2026-50447

Exploitation requires that the target host has the optional Message Queuing (MSMQ) feature installed and enabled and that its MSMQ listener (TCP 1801 and associated RPC ports) is network-reachable from the attacker - MSMQ is not enabled by default, so this non-default configuration is the key limiting factor. Given the CVSS vector AV:N/AC:L/PR:N/UI:N, once MSMQ is exposed there are no further conditions: exploitation is remote, unauthenticated, and requires no user interaction. Realistic risk is therefore bounded almost entirely by whether the Message Queuing service is running and how its port exposure is firewalled, not by authentication or victim action.

This is a genuine top-tier priority, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes remote, low-complexity, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact - the classic wormable RCE profile. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so probabilistic and active-exploitation signals cannot be quantified here; the absence of KEV means there is no confirmed active exploitation, and no POC was referenced, so no public exploit is identified at time of analysis. The main mitigating factor is exposure: MSMQ is not installed or enabled by default on most systems, so real-world risk is concentrated on the subset of hosts where the Message Queuing feature is turned on and its port is reachable. Where MSMQ is exposed, this should be treated as critical and patched immediately.

An attacker who can reach TCP port 1801 on a host with MSMQ enabled sends a single crafted Message Queuing packet that triggers the heap-based buffer overflow in the message parser, corrupting heap memory to hijack execution and run code in the context of the MSMQ service. Because the CVSS vector requires no authentication and no user interaction (PR:N/UI:N) with low complexity (AC:L), a successful exploit needs only network reachability to the service. No public exploit is identified at time of analysis, though the pre-auth network RCE profile makes reliable exploitation plausible if one is developed.