Windows MSMQ EUVD-2026-73916

MSMQ must be installed and enabled on the target Windows system - it is an optional Windows feature, not installed by default. When present, MSMQ listens on TCP port 1801 and UDP 1801/2101/2103/2105; the attacker must be able to reach this port. No authentication is required and no user interaction is needed. Exploitation requires high attack complexity (AC:H), consistent with the need to manipulate heap memory layout or trigger a precise race condition - this is a significant barrier and means reliable weaponization requires substantial exploit development effort. Systems that have never had MSMQ installed are entirely unexposed. The scope is limited to the MSMQ service process (S:U), so successful exploitation does not automatically escape to the OS kernel, though the MSMQ service account privileges determine lateral impact.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that this is a high-severity but non-trivial-to-exploit vulnerability: unauthenticated network reachability is paired with high attack complexity, which historically for UAF means reliable exploitation requires non-trivial heap-grooming. No CISA KEV listing is present and no public POC has been identified, suggesting this has not yet seen widespread exploitation. EPSS data is not provided, so exploitation probability cannot be quantified. The critical limiting factor is that MSMQ is not installed or enabled by default on modern Windows - organizations that have never deployed MSMQ are unexposed entirely. Enterprises running legacy middleware, ERP systems, or BizTalk Server commonly have MSMQ active, and for those, this is a genuine priority: a remote unauthenticated attacker on TCP/1801 with a working exploit could fully compromise the MSMQ service process. The combination of no required privileges, no user interaction, and full CIA impact means that when MSMQ is exposed, the blast radius is severe despite the high AC.

An attacker on the same network or internet-reachable to TCP port 1801 sends a sequence of crafted MSMQ protocol messages designed to trigger a race condition or heap layout enabling UAF - causing the MSMQ service to dereference freed memory under attacker-controlled content. Successful exploitation yields arbitrary code execution in the context of the MSMQ service process. No public POC has been identified, so reliable exploitation currently requires significant reverse-engineering investment.