Windows Message Queuing CVE-2026-65790

Exploitation requires an authorized (locally authenticated) user account on the target Windows system - CVSS PR:L confirms low-privileged local access is sufficient and no elevated rights are needed. The Windows Message Queuing (MSMQ) service must be installed and running; MSMQ is not enabled by default in modern Windows versions and must be explicitly added as a Windows Feature, which limits exposure to systems where it has been deliberately configured. No user interaction is required (UI:N). Attack complexity is low (AC:L), meaning no race conditions or special environment states must be achieved. The scope does not change (S:U), so impact is contained to the vulnerable system. Exploitation is limited by: (1) requirement for local authenticated access - remote unauthenticated exploitation is not indicated by the CVSS vector; (2) MSMQ must be enabled, a non-default configuration on most modern Windows deployments.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector, low complexity, and low privilege requirement - meaning any authenticated local user can attempt exploitation without special configuration or user interaction. This is a significant post-exploitation primitive: an attacker who has gained initial access via phishing, credential theft, or a remote vulnerability can use this to escalate to SYSTEM. EPSS data is not provided in the input, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV and no POC has been identified, suggesting opportunistic mass exploitation is not currently occurring. However, the low complexity and no-UI-required characteristics mean that reliable exploitation is likely achievable by a skilled attacker once local access is established. The requirement for local access meaningfully limits the attack surface compared to network-exploitable privilege escalation vulnerabilities, but organizations with shared systems, RDP exposure, or lateral-movement-prone environments should treat this as urgent. SSVC signals: exploitation status is none confirmed; the flaw is not automatable from the network; technical impact is total given C:H/I:H/A:H.

An attacker who has obtained a low-privileged shell on a Windows host - through phishing, a web application compromise, or credential reuse - identifies that the MSMQ service is running. By sending a crafted message or invoking a vulnerable MSMQ API call that triggers the heap-based buffer overflow, the attacker corrupts heap metadata and redirects execution to attacker-controlled code, gaining SYSTEM-level privileges. No public proof-of-concept is known at time of analysis, but the low attack complexity rating suggests exploit development is feasible for a skilled researcher.