Windows Message Queuing EUVD-2026-99562

Exploitation requires that the Microsoft Message Queuing (MSMQ) feature - specifically the Queue Manager - is installed and running on the target host; MSMQ is an optional Windows component that is not enabled by default, which significantly limits the exposed population. The attacker must already possess local, low-privilege authenticated access to the machine (CVSS PR:L, AV:L); the flaw cannot be reached remotely or anonymously and offers no path to initial access. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the service is present and the attacker has a foothold, reliable elevation to SYSTEM is the limiting case rather than any special configuration beyond MSMQ being enabled.

This is a credible local privilege-escalation issue but not a drop-everything emergency. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) consistently describes a low-complexity local attack requiring only low existing privileges, yielding full confidentiality, integrity and availability impact on the host - a textbook user-to-SYSTEM elevation. There is no CISA KEV listing and no public exploit identified, so active exploitation is not indicated; EPSS and SSVC data were not supplied, so automatability and exploitation-maturity cannot be scored. The lack of a network vector (AV:L) means this cannot be used for initial access - an attacker must already have code execution as a low-privileged user, which materially lowers real-world urgency versus a remote flaw of the same score. One signal to verify: the input Tags include 'Denial Of Service', yet the description and CVSS (C:H/I:H/A:H, 'elevate privileges') point to privilege escalation as the primary impact - treat DoS as at most a secondary effect of the use-after-free. Overall: a patch-in-normal-cycle elevation bug, prioritized higher only on multi-user or shared hosts where MSMQ is enabled.

A low-privileged user (or malware already running in a standard user context) who has local access to a Windows host with the Message Queuing service enabled triggers a use-after-free in the MSMQ Queue Manager to corrupt memory and execute code at SYSTEM. No user interaction is needed and attack complexity is low, but the attacker must already be authenticated on the machine. No public proof-of-concept exploit was identified at the time of analysis.