Windows MSMQ EUVD-2026-73122

The MSMQ (Message Queuing) Windows service must be installed and running - it is an optional component not enabled by default on modern Windows installations, so this vulnerability only affects systems where an administrator has explicitly installed and started MSMQ. TCP port 1801 (the default MSMQ listener) must be reachable from the attacker's network position; perimeter firewall rules that block this port prevent remote exploitation. No authentication is required (PR:N). The vulnerability is not exploitable on systems where MSMQ is absent or stopped. No user interaction is required. The impact is limited to availability (denial of service) - confidentiality and integrity are not affected (C:N/I:N per CVSS vector).

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a straightforward unauthenticated network-reachable DoS with no complexity barriers. However, real-world risk is gated by whether the MSMQ service is installed and network-accessible - MSMQ is an optional Windows component not enabled by default on modern installations, which meaningfully reduces exposure compared to a vulnerability in a universally-present service. No KEV listing and no public exploit code further lower immediate priority for most organizations. The breadth of affected versions (Server 2012 through Server 2025, Windows 10 through 11 25H2) does expand aggregate exposure across enterprise fleets. Two input tags - 'Buffer Overflow' and 'Information Disclosure' - are inconsistent with the actual CWE-125 and the C:N CVSS metric; the real impact is availability-only DoS, which should be weighted accordingly in triage. EPSS data is not provided in this intelligence package; exploitation probability is not independently assessable.

An unauthenticated remote attacker sends a specially crafted MSMQ protocol message to TCP port 1801 on a Windows host running the MSMQ service. The Queue Manager processes the malformed input, triggers the out-of-bounds read, and crashes, rendering the MSMQ service unavailable and disrupting any dependent messaging workflows. No exploit code is publicly available at time of analysis, but the low complexity (AC:L, no prerequisites beyond network access) means a functional exploit could be developed from the vulnerability description alone.