Windows Message Queuing EUVD-2026-44106

Exploitation requires that the optional Windows Message Queuing (MSMQ) feature be installed and its service running and network-reachable on the target - MSMQ is not enabled by default, which is the primary factor limiting real-world exposure. The attacker also needs low-level privileges (CVSS PR:L), so this is not a fully unauthenticated flaw; some prior access or authenticated context is required. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Additional limiting factors: only the enumerated Windows client/server builds below the fixed versions are vulnerable, and SSVC marks the attack as not automatable, implying reliable exploitation is non-trivial.

Signals are mixed and point to a real-but-not-urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity flaw needing only low privileges and no user interaction, with total confidentiality/integrity/availability impact - consistent with the SSVC 'Technical Impact: total' rating. However, SSVC also marks Exploitation as 'none' and Automatable as 'no,' and EPSS is only 0.48% (38th percentile), so widespread or automated exploitation is not currently indicated. There is no CISA KEV listing and no public exploit identified at time of analysis. Net: a high-severity memory-corruption RCE worth prompt patching, but not evidence of active mass exploitation. One caveat to verify: MSMQ RCEs historically depend on the optional MSMQ feature being installed, which is not reflected in the CVSS PR:L metric - the practical attack surface is narrower than the network vector alone suggests.

An attacker with a low-privileged foothold and network reachability to a Windows host running the MSMQ service sends a specially crafted sequence of queued messages that triggers the use-after-free, corrupting service memory to hijack execution and run arbitrary code in the context of the Message Queuing service. No user interaction is required, and exploitation over the network is low-complexity per the CVSS vector. No public exploit code has been identified at time of analysis.