Windows MSMQ EUVD-2026-99564

Exploitation requires that the optional Windows Message Queuing (MSMQ) service be installed and running on the target, which is NOT enabled in default Windows installations - the Queue Manager must be listening (typically TCP 1801) and network-reachable. The CVSS vector's PR:L means the attacker must hold valid (low-privilege) credentials/authorization to the MSMQ service, so this is not an unauthenticated flaw; no user interaction is required (UI:N). Impact is limited to denial of service (A:H only; C:N/I:N) - the service crashes but no data is exposed or altered. The requirement for an enabled non-default component plus authentication materially limits real-world exposure.

This is a moderate, service-availability-only risk that should not be over-prioritized despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) shows a network-reachable, low-complexity flaw but one that requires authentication (PR:L) and yields only an availability impact (A:H) with zero confidentiality or integrity effect - consistent with a null pointer dereference (CWE-476) that crashes the MSMQ Queue Manager rather than enabling code execution. Multiple low-risk signals align and reinforce each other: CISA's SSVC framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are consistent rather than conflicting - a crash-only DoS requiring valid credentials and a non-default service. The one nuance to verify: the description says 'authorized attacker,' which matches PR:L, so this is not an unauthenticated internet-wide DoS.

An attacker with valid network credentials sends a crafted Message Queuing protocol message to a Windows host running the MSMQ service, triggering a null pointer dereference in the Queue Manager that crashes the service and denies message-queuing functionality to legitimate users. Because the flaw is low-complexity over the network, repeated requests could sustain the outage, but no code execution or data exposure results. No public proof-of-concept exploit is identified at time of analysis.