Windows Message Queuing CVE-2026-85874

Requires the Windows Message Queuing (MSMQ) feature to be installed and enabled, which is NOT a default Windows configuration - the vulnerable Queue Manager service must be present on the host. Per CVSS AV:L/PR:L, the attacker must already have local, authenticated low-privilege access to the machine (no remote or anonymous path, no user interaction). These factors - local-only access, prior authentication, and the optional non-default MSMQ feature - collectively limit realistic exploitation to hosts where MSMQ is deliberately deployed and the attacker has an existing foothold.

This is a plausible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with the description ('execute code locally' by an 'authorized attacker'): exploitation requires local access and some existing privilege (PR:L), with no user interaction, yielding full C:H/I:H/A:H - a classic local privilege-escalation profile for a CWE-416 use-after-free, score 7.8 (High). No EPSS score, KEV entry, or POC was provided in the input, so there is no signal of active or probable exploitation; per the rules this is 'no public exploit identified at time of analysis.' The local-only vector (AV:L) and the requirement for prior authenticated access substantially limit real-world risk versus a network-reachable bug - an attacker must already have a foothold on the host. A further limiting factor not captured by CVSS is that the affected component, Windows Message Queuing (MSMQ), is an optional Windows feature that is not installed or enabled by default. Net: patch during normal cycles, prioritize on hosts where MSMQ is actually enabled; this is not an emergency absent exploitation evidence. Note the 'Denial Of Service' tag partially conflicts with the description, which states code execution - the UAF could plausibly cause both, but code execution (reflected in I:H) is the primary impact.

A low-privileged but authenticated local user on a Windows host that has the Message Queuing (MSMQ) feature enabled sends crafted input to the Queue Manager to trigger the use-after-free, reclaiming the freed object with attacker-controlled data. By controlling the dangling pointer's contents, the attacker executes arbitrary code in the context of the vulnerable service, escalating privileges. No public exploit or POC was identified in the provided data, and no user interaction is required (UI:N).