Windows MSMQ CVE-2026-54992

Requires the optional Message Queuing (MSMQ) feature to be installed and its Queue Manager service running - a non-default component, which sharply limits the exposed population to hosts that have explicitly enabled MSMQ. The CVSS vector is AV:L/AC:L/PR:L/UI:N, so the attacker must already have local, authenticated low-privilege code execution on the target (no remote or unauthenticated path, and no user interaction needed). Limiting factors: local access prerequisite, dependency on the non-default MSMQ feature, and the need for a pre-existing foothold; no special network configuration is involved.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local attack requiring low privileges but no user interaction, yielding total confidentiality, integrity, and availability impact - consistent with SSVC 'Technical Impact: total.' Countervailing signals lower the real-world urgency: SSVC 'Exploitation: none' and 'Automatable: no,' plus a low EPSS score of 0.39% (31st percentile), suggest no widespread or automated exploitation to date. This is NOT in CISA KEV. The one elevating factor is that publicly available exploit code exists, which shortens the window for opportunistic post-compromise use. Net: a credible local privilege-escalation primitive suited to the second stage of an intrusion rather than an internet-facing mass-exploitation threat - prioritize patching where MSMQ is enabled, but it is not a drop-everything network emergency. Note the local vector means an attacker must already have a foothold and code execution on the host.

An attacker who has already gained low-privileged local access to a Windows host with MSMQ installed - for example via a phishing-delivered user session or a compromised service account - invokes the vulnerable Queue Manager code path with crafted queue data to overflow a heap buffer. Leveraging the publicly available exploit code, they corrupt heap memory to execute code in the privileged MSMQ service context, escalating from a limited user to SYSTEM. This turns an initial low-value foothold into full control of the machine for persistence and lateral movement.