EUVD-2026-99564
GHSA-mx2v-9fqv-wjvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MSMQ service over network
-
ExploitSend crafted Message Queuing request
-
ExecutionTrigger null pointer dereference in Queue Manager
-
ImpactCrash service and deny availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the optional Windows Message Queuing (MSMQ) service be installed and running on the target, which is NOT enabled in default Windows installations - the Queue Manager must be listening (typically TCP 1801) and network-reachable. The CVSS vector's PR:L means the attacker must hold valid (low-privilege) credentials/authorization to the MSMQ service, so this is not an unauthenticated flaw; no user interaction is required (UI:N). Impact is limited to denial of service (A:H only; C:N/I:N) - the service crashes but no data is exposed or altered. The requirement for an enabled non-default component plus authentication materially limits real-world exposure. |
| Impact | This is a moderate, service-availability-only risk that should not be over-prioritized despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows a network-reachable, low-complexity flaw but one that requires authentication (PR:L) and yields only an availability impact (A:H) with zero confidentiality or integrity effect - consistent with a null pointer dereference (CWE-476) that crashes the MSMQ Queue Manager rather than enabling code execution. Multiple low-risk signals align and reinforce each other: CISA's SSVC framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are consistent rather than conflicting - a crash-only DoS requiring valid credentials and a non-default service. The one nuance to verify: the description says 'authorized attacker,' which matches PR:L, so this is not an unauthenticated internet-wide DoS. |
| Exploit ScenarioDerived | An attacker with valid network credentials sends a crafted Message Queuing protocol message to a Windows host running the MSMQ service, triggering a null pointer dereference in the Queue Manager that crashes the service and denies message-queuing functionality to legitimate users. Because the flaw is low-complexity over the network, repeated requests could sustain the outage, but no code execution or data exposure results. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Microsoft Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privileged remote attacker to crash the service by triggering a null pointer dereference, rendering the queuing service unavailable to legitimate applications on the affected host. Exploitation is constrained: MSMQ is an optional, non-default Windows component that must be installed, running, and network-reachable (typically TCP 1801), and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms credentials are required while no user interaction is needed. Impact is purely availability (A:H with C:N/I:N) - no data exposure or modification - and there is no public exploit identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available for all affected Windows client and server branches.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85859), which is available from the vendor; upgrade each affected branch to at least its fixed build - Windows 11 24H2 to 10.0.26100.9711, Windows 11 23H2 to 10.0.22631.7652, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows 10 22H2/21H2 to 10.0.19044.7807, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9376, Windows 10 1607 and Windows Server 2016 to 10.0.14393.9612, Windows Server 2022 to 10.0.20348.5761, Windows Server 2025 to 10.0.26100.33650, Windows Server 2012 R2 to 6.3.9600.23470, and Windows Server 2012 to 6.2.9200.26434. Because the attack surface exists only where MSMQ is enabled, the most effective compensating control is to remove the Message Queuing feature (or set the Message Queuing service startup type to Disabled on hosts that do not require it) - the trade-off being that any application relying on MSMQ store-and-forward messaging will stop working, so this must be validated against the application inventory first. Where MSMQ must stay in service, restrict network reachability: block inbound TCP 1801 and the MSMQ RPC/RPC-over-TCP and directory-service ports at the host firewall and at network boundaries so only trusted, authorized messaging peers can reach the Queue Manager, accepting the operational cost of tighter segment-level access control and the risk of breaking legitimate cross-subnet messaging. Also enforce least privilege so that only necessary accounts are authorized to interact with the messaging service, since the CVSS vector requires low privileges (PR:L) and reducing the pool of authorized callers shrinks the attacker population that can trigger the crash. There is no indication of active exploitation or public exploit code, so patching can follow normal risk-based maintenance windows rather than emergency change processes, prioritizing internet-exposed or multi-tenant MSMQ hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a null pointer dereference (CWE-476) in the Windows Message Queuing Queue Manager, the service component that brokers store-and-forward messaging between MSMQ clients and queues. CWE-476 covers precisely this root-cause class: code dereferences a pointer that it failed to validate (for example, a queue, session, or message-structure lookup returning NULL during request processing), and because the dereference occurs without a guard, the Queue Manager process faults and terminates rather than returning an error. MSMQ is an opt-in Windows feature (Message Queuing via 'Turn Windows features on or off', or the MSMQ Server role on Windows Server), and when enabled the Queue Manager listens for messaging traffic on TCP 1801 plus the MSMQ RPC/RPC-over-TCP and directory-service ports; it is not exposed or active in a default installation, which is the single largest constraint on real-world exploitability. The CVSS vector places the attack over the network (AV:N) at low complexity (AC:L) but requires low privileges (PR:L), meaning the attacker must already hold valid authorization to interact with the messaging service rather than being an anonymous internet client; scope is unchanged (S:U), and the sole impact is high availability loss (A:H). The EUVD data enumerates affected build baselines across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installation variants, confirming the vulnerable binary is shared across the modern Windows servicing branches.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable MSMQ service with low complexity but requires authorization (PR:L); null pointer dereference yields availability-only impact, so C:N/I:N/A:H, matching the vendor 6.5 score.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB