Windows Message Queuing EUVD-2026-56637

Exploitation requires a locally authenticated session with at minimum a low-privileged (non-administrative) user account on the target Windows system, as confirmed by the CVSS vector PR:L/AV:L. The Windows Message Queuing (MSMQ) service must be installed and running on the target - MSMQ is not enabled by default in standard Windows installations and must be explicitly added as a Windows Feature; this is the primary limiting factor for most environments. No network accessibility to the vulnerable service is required - the attacker must have local code execution. No user interaction is required beyond the attacker's own actions. Exploitation is constrained by: (1) the need for pre-existing local authenticated access, (2) MSMQ being explicitly enabled as a Windows Role/Feature on the target, and (3) no network-only attack path exists per the local attack vector.

The CVSS 7.8 High score is well-supported by the vector: local access with low privileges and low attack complexity, yielding full confidentiality, integrity, and availability impact. This is a classic local privilege escalation profile - high severity but constrained by the requirement for pre-existing local code execution. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no proof-of-concept code was identified at time of analysis, reducing immediate weaponization risk. However, the extremely broad affected version range - spanning Windows Server 2012 through Server 2025 and virtually all supported Windows 10/11 branches - means the attack surface is enormous in enterprise environments where MSMQ is enabled. Real-world risk is moderate-to-high for organizations using MSMQ: attackers who gain initial low-privilege access (via phishing, credential theft, or other means) could reliably use this to achieve SYSTEM-level persistence. For organizations where MSMQ is not deployed, risk is negligible.

An attacker who has already obtained a low-privileged local user account - for example, through credential phishing or exploitation of an RCE vulnerability - sends a specially crafted message to the Windows Message Queuing service, triggering a heap-based buffer overflow in MSMQ's message processing code. By corrupting heap metadata or control-flow data, the attacker redirects execution to shellcode running as SYSTEM, achieving full operating system compromise with no additional user interaction required. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the overflow primitive is straightforward to exploit once the message format is reversed.