EUVD-2026-44106
GHSA-vgq9-7jrx-rfx5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged network access to MSMQ host
-
DeliverySend crafted queued messages to service
-
ExploitTrigger use-after-free in mqsvc
-
ExecutionCorrupt heap and hijack execution
-
ImpactExecute arbitrary code as service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the optional Windows Message Queuing (MSMQ) feature be installed and its service running and network-reachable on the target - MSMQ is not enabled by default, which is the primary factor limiting real-world exposure. The attacker also needs low-level privileges (CVSS PR:L), so this is not a fully unauthenticated flaw; some prior access or authenticated context is required. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Additional limiting factors: only the enumerated Windows client/server builds below the fixed versions are vulnerable, and SSVC marks the attack as not automatable, implying reliable exploitation is non-trivial. |
| Impact | Signals are mixed and point to a real-but-not-urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity flaw needing only low privileges and no user interaction, with total confidentiality/integrity/availability impact - consistent with the SSVC 'Technical Impact: total' rating. However, SSVC also marks Exploitation as 'none' and Automatable as 'no,' and EPSS is only 0.48% (38th percentile), so widespread or automated exploitation is not currently indicated. There is no CISA KEV listing and no public exploit identified at time of analysis. Net: a high-severity memory-corruption RCE worth prompt patching, but not evidence of active mass exploitation. One caveat to verify: MSMQ RCEs historically depend on the optional MSMQ feature being installed, which is not reflected in the CVSS PR:L metric - the practical attack surface is narrower than the network vector alone suggests. |
| Exploit ScenarioDerived | An attacker with a low-privileged foothold and network reachability to a Windows host running the MSMQ service sends a specially crafted sequence of queued messages that triggers the use-after-free, corrupting service memory to hijack execution and run arbitrary code in the context of the Message Queuing service. No user interaction is required, and exploitation over the network is low-complexity per the CVSS vector. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 22, 2026
Remote code execution in the Microsoft Message Queuing (MSMQ) service across Windows 10, Windows 11 (through 26H1), and Windows Server 2012-2025 allows an authorized (PR:L) attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Microsoft self-reported the flaw and has shipped fixed builds; SSVC rates exploitation as none and EPSS is low (0.48%, 38th percentile), so there is no public exploit identified at time of analysis despite the high 8.8 CVSSv3.1 base score.
Earlier versions of this analysis (1)
Remote code execution in the Microsoft Windows Message Queuing (MSMQ) service arises from a use-after-free (CWE-416) memory-corruption flaw that an authenticated attacker can trigger across a network to run arbitrary code in the service context. It affects a broad range of supported Windows client and server releases from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 wherever the MSMQ component is enabled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft rates it CVSS 7.5 and has released a fix.
RemediationAI
Vendor-released patch: install the fixed cumulative build for your SKU (e.g. Windows 11 24H2 10.0.26100.8875, 25H2 10.0.26200.8875, 26H1 10.0.28000.2525; Windows 10 21H2 10.0.19044.7548 / 22H2 10.0.19045.7548; Server 2022 10.0.20348.5386; Server 2025 10.0.26100.33158; Server 2019 10.0.17763.9020; Server 2016 10.0.14393.9339; Server 2012 6.2.9200.26226; Server 2012 R2 6.3.9600.23291) as listed in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50505. Where immediate patching is not possible, the most effective compensating control is to remove or disable the Message Queuing Windows feature on hosts that do not require it, which fully eliminates the vulnerable service but breaks any application that relies on MSMQ. If MSMQ must remain enabled, restrict exposure by blocking inbound MSMQ traffic (TCP 1801 and the MSMQ RPC/HTTP ports) at the host and perimeter firewall and limiting access to trusted management segments only - this reduces reachability but will disrupt legitimate remote queue clients. Because exploitation requires at least low privileges (PR:L), tightening account access and network segmentation around MSMQ hosts further lowers risk until patches are applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Windows Message Queuing (MSMQ), an optional Windows messaging middleware that accepts queued messages over the network (typically TCP/1801 and related RPC/HTTP endpoints) via the Message Queuing service (mqsvc.exe). The root cause is CWE-416 (use-after-free): the service dereferences or reuses a heap object after it has been freed, which an attacker can influence to corrupt memory and redirect execution. The CPE and EUVD data confirm this is a first-party Microsoft OS component spanning client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2012, 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations), meaning any of these builds with the MSMQ feature installed exposes the vulnerable code path.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable MSMQ service (AV:N), no user interaction, low-complexity trigger, but requires low privileges (PR:L); use-after-free RCE yields total C/I/A impact within the service scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Use after free in Windows Message Queuing allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft's Message Queuing service (MSMQ) contains a remote code execution vulnerability (CVE-2026-50505, CVSS 8.8) affecting Windows 10, 11, and Server 2012-2025 that allows authenticated attackers to execute arbitrary code through memory corruption. No public exploit has been identified at time of analysis, and exploitation requires valid user credentials, limiting current risk; however, the high severity score creates material risk if internal accounts are compromised. A vendor patch is available and must be deployed to eliminate this attack vector from messaging infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB