Windows Message Queuing EUVD-2026-73028

Exploitation requires a locally authenticated account with at minimum low-level privileges (standard user or service account) on the target Windows system. The Windows Message Queuing (MSMQ) feature must be installed and running - MSMQ is an optional Windows component and is NOT enabled by default; it requires explicit installation via Windows Features or Server Manager. AC:H indicates that successful exploitation depends on winning a timing race condition, which reduces reliability and may require repeated attempts. Physical or interactive local access is not strictly required if the attacker has a remote shell, but the AV:L vector confirms no direct network-facing exploitation path exists. Exploitation is limited by: (1) MSMQ must be installed and the service running; (2) attacker must have a local authenticated session with at least low-privileged rights; (3) race condition must be won reliably, which adds complexity.

Real-world risk is moderate-to-high for environments where MSMQ is actively deployed. The local attack vector (AV:L) substantially limits exposure compared to network-reachable vulnerabilities - an attacker must already have authenticated local access with at least low-privileged credentials, ruling out remote exploitation. The AC:H metric indicates a race condition or memory-timing dependency that reduces reliable exploitation; exploit reliability is consequently lower than typical stack or heap overflows. No EPSS score was provided in the input data, and the vulnerability is not in CISA KEV, meaning no confirmed in-the-wild exploitation is known. However, MSMQ is frequently present in enterprise environments running legacy applications or BizTalk Server workloads, and a post-compromise LPE gadget is highly valuable to attackers who have already obtained initial foothold. The broad version range (Server 2012 through Windows 11 26H1) means unpatched exposure is significant in organizations with deferred patching cycles.

An attacker who has obtained a low-privileged shell on a Windows server running MSMQ - for example via a compromised service account or phishing - triggers the use-after-free by racing two MSMQ operations that interact with the same queue handle. By winning the race and controlling the freed memory region's reallocation with crafted content, the attacker redirects execution within the MSMQ service, achieving SYSTEM-level code execution and full control of the host. No public proof-of-concept has been identified at time of analysis.