Windows Message Queuing CVE-2026-62719

Exploitation requires an authenticated local session on the target Windows host with at least low-privilege (standard user) credentials, as confirmed by the CVSS vector PR:L and AV:L. The Windows Message Queuing (MSMQ) service must be installed and running on the target system - MSMQ is an optional Windows feature and is not enabled by default on all editions, meaning hosts without MSMQ are entirely unexposed. No user interaction from a second party is required (UI:N). No network-facing exposure is involved; the attacker must already have interactive or programmatic local access. The primary limiting factors are: (1) MSMQ must be enabled, which is deployment-specific, and (2) the attacker must have an authenticated local session - remote unauthenticated exploitation is not possible per the CVSS vector.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects an LPE flaw that is reliable once an attacker has local access: low complexity and no user interaction mean exploitation does not depend on timing or social engineering. The local attack vector (AV:L) constrains the threat model to post-initial-access scenarios - this is a chaining vulnerability rather than an entry point, meaning its practical risk is highest in environments where MSMQ is enabled and adversaries have already obtained a foothold. No EPSS data was provided, no CISA KEV listing exists, and no POC has been identified in the supplied intelligence, all of which moderately reduce urgency compared to network-exploitable or KEV-listed LPEs. However, low complexity and no user interaction mean that if exploitation tooling becomes available, reliable chaining into SYSTEM is straightforward. The breadth of affected Windows versions (Server 2012 through 2025, Windows 10/11 across many feature releases) significantly expands attack surface in enterprise fleets. Risk is real but contextual: environments that have disabled or do not deploy MSMQ are unexposed, while those with MSMQ enabled and unpatched endpoints face meaningful post-compromise escalation risk.

An attacker who has obtained a low-privilege local account on a Windows host with MSMQ enabled - for example through phishing, credential theft, or initial exploitation of another vulnerability - sends a crafted message or API call to the MSMQ service that triggers the heap buffer overflow. By corrupting heap metadata or a function pointer within the privileged MSMQ service process, the attacker redirects execution to shellcode or a ROP chain, achieving SYSTEM-level code execution. No public proof-of-concept has been identified at the time of analysis, but the AV:L/AC:L conditions indicate the overflow trigger is not complex once the attack approach is understood.