Windows Message Queuing CVE-2026-85334

Requires the Windows Message Queuing (MSMQ) service to be installed and enabled - this is an optional Windows component that is NOT present in default installations, which is the primary factor limiting real-world exposure. When enabled, MSMQ listens on TCP port 1801 (and related ports 2101/2103/2105) and must be reachable from the attacker's network position. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so any Windows or Windows Server host with the Message Queuing feature exposed to untrusted networks is exploitable; conversely, hosts without MSMQ installed are not affected regardless of patch level.

This is a genuine patch-priority issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the 7.5 HIGH score is driven entirely by confidentiality (C:H/I:N/A:N) - it is an information-disclosure bug, not code execution. The signals are internally consistent and point to moderate real-world urgency: CISA's SSVC framework lists Exploitation as 'none' (no observed exploitation), which agrees with the absence of a CISA KEV listing and no public exploit - so the status is 'no public exploit identified at time of analysis.' SSVC 'Automatable: yes' plus 'Technical Impact: partial' means that IF an exploit emerges it could be scripted at scale, which is why MSMQ bugs historically attract attacker interest even though this one leaks memory rather than granting RCE. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. Net: treat as a standard high-priority Patch Tuesday fix - apply the Microsoft update - but it is not currently in the actively-exploited tier.

A remote, unauthenticated attacker who can reach the Message Queuing service (TCP 1801) over the network sends a specially crafted MSMQ packet that drives the Queue Manager to read past the bounds of an allocated buffer. The out-of-bounds read returns adjacent process memory to the attacker, potentially leaking sensitive data such as pointers or buffer contents. No public exploit code has been identified at the time of analysis, and SSVC marks exploitation status as none.