Windows Message Queuing CVE-2026-69579

Exploitation requires that the target host has the optional Windows Message Queuing (MSMQ) feature installed and the service running with its listener (typically TCP port 1801) reachable by the attacker - MSMQ is not present in default Windows installations, which is the primary limiting factor. Given AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no non-default tuning beyond MSMQ being enabled are needed; any network-reachable MSMQ endpoint is exploitable regardless of Windows/Server edition (client, server, or Server Core).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a maximally severe network-reachable, unauthenticated, no-interaction RCE - the classic 'wormable service' profile that MSMQ RCEs have historically fit. The single strongest mitigating factor is that MSMQ is NOT installed or enabled by default: only hosts that have explicitly added the Message Queuing feature and expose TCP 1801 are actually exploitable, which sharply narrows the real-world attack surface relative to the 9.8 headline. No EPSS score, KEV entry, or POC is present in the provided data, so there is no evidence of active exploitation or public weaponization yet; treat this as high priority for MSMQ-enabled hosts and lower priority elsewhere. Note the 'Denial Of Service' tag conflicts with the description and CVSS I:H/C:H - the confirmed impact is code execution, not merely availability loss.

An attacker on a network path to a Windows host that has the MSMQ feature enabled and TCP 1801 exposed sends a crafted sequence of MSMQ protocol messages that triggers the use-after-free in the message-queuing service. By grooming the heap so the freed object is replaced with attacker-controlled data, they gain code execution in the service context without any credentials or user interaction. No public POC is currently identified, but the unauthenticated network vector makes MSMQ-exposed hosts an attractive target.