Executive brief
Windows Message Queuing (MSMQ) is a core messaging service used for asynchronous communication in enterprise applications. An attacker can exploit a use-after-free vulnerability in this service to execute arbitrary code remotely without authentication, potentially compromising servers and client systems that rely on message queue functionality.
Technical details
A use-after-free vulnerability exists in Windows Message Queuing, where the service incorrectly manages memory for queue objects. An attacker can send a specially crafted network request to trigger the vulnerability and execute arbitrary code with system privileges. The vulnerability is network-reachable and requires no prior authentication or user interaction. Patch availability is expected from Microsoft's Security Update Guide.
Affected products
- Microsoft Windows Message Queuing
Timeline
- 2026-09-08: disclosed