CVE-2026-50447

What it actually does

This is a network-reachable heap-based buffer overflow in Microsoft Message Queuing (MSMQ). An unauthenticated remote attacker can send specially crafted MSMQ traffic to a vulnerable Windows host running the Message Queuing service and corrupt heap memory in a way that can lead to arbitrary code execution. Because the CVSS vector is network, low complexity, no privileges, and no user interaction, successful exploitation can provide high-impact compromise of confidentiality, integrity, and availability on the affected system.

Why it matters to the business

Systems with MSMQ enabled may be remotely compromised without valid credentials, creating risk of server takeover, lateral movement, service disruption, data theft, or deployment of malware. The affected product range spans many supported Windows client and server releases, including Windows Server 2012 through Server 2025 and Windows 10/11 versions, so exposure may exist in legacy application stacks that use MSMQ for asynchronous messaging. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the 9.8 severity and unauthenticated network attack path make exposed MSMQ services high-priority patching candidates.

How an attack unfolds

An attacker first identifies Windows hosts with Microsoft Message Queuing enabled and reachable over the network, commonly by finding systems listening for MSMQ-related traffic such as TCP port 1801. The attacker then sends a malformed MSMQ message or protocol sequence crafted to trigger a heap buffer overflow in the MSMQ service. If memory corruption is successfully controlled, the attacker can execute code in the context of the vulnerable service, potentially installing malware, creating persistence, dumping credentials, staging additional tooling, or using the compromised host as a pivot point. Failed attempts may crash the Message Queuing service or produce Windows Error Reporting artifacts and service-control events.

How to fix it

Apply Microsoft security updates for all affected Windows versions as soon as they are available for this vulnerability. Prioritize Windows Server systems and any host where Message Queuing is enabled or reachable from untrusted networks. If immediate patching is not possible, disable the Message Queuing service where it is not required, remove the MSMQ Windows feature from systems that do not need it, and restrict MSMQ access to trusted application hosts only. Block inbound MSMQ exposure from untrusted networks, especially TCP/1801 and associated RPC access, using host firewalls, network firewalls, and segmentation controls. Review business applications before disabling MSMQ because some legacy or distributed applications depend on it for message delivery.

How to confirm the fix worked

Confirm each affected host has installed the Microsoft update that remediates this vulnerability once published by the vendor. Validate that MSMQ is disabled or removed on systems where it is not required. On systems that require MSMQ, verify network controls limit inbound MSMQ access to approved sources only. Use service inventory, PowerShell, endpoint management, or vulnerability scanning to identify hosts where the Message Queuing service is installed or running. Confirm externally and internally that TCP/1801 is not reachable except from explicitly approved systems. After patching or mitigation, re-run authenticated vulnerability scans and review Windows update compliance reports for all affected Windows Server and Windows client versions.

Typical attack path

1. Scan internal or internet-facing address ranges for Windows hosts exposing MSMQ, especially TCP/1801 and related RPC-accessible services.
2. Confirm that the Message Queuing service is enabled and reachable from the attacker’s network location.
3. Send specially crafted MSMQ network traffic designed to trigger the heap-based buffer overflow.
4. Achieve remote code execution if the heap corruption is successfully exploited.
5. Run post-exploitation commands or payloads under the compromised service context.
6. Establish persistence, collect credentials or sensitive data, and move laterally to other Windows systems.

How to detect it

To assess prior exploitation, review Windows endpoint, network, and EDR telemetry for MSMQ exposure and abnormal behavior. Key sources include Windows System event logs, Application logs, Windows Error Reporting logs, Service Control Manager events, Microsoft-Windows-MSMQ operational logs if enabled, firewall logs, NetFlow, IDS/IPS logs, and EDR process trees. Look for unexpected inbound connections to MSMQ ports, especially TCP/1801, followed by crashes or restarts of the Message Queuing service. Investigate any faulting application events for mqsvc.exe, unexplained service terminations, heap-corruption or access-violation crash records, suspicious child processes spawned from service contexts, newly written executables or scripts after MSMQ activity, and authentication or lateral-movement activity originating from an MSMQ server. Because no public exploit maturity is reported, detections should emphasize behavioral anomalies rather than relying only on known exploit signatures.

• mqsvc.exe
• TCP/1801
• Port 1801
• Message Queuing
• MSMQ
• Microsoft-Windows-MSMQ
• Faulting application name: mqsvc.exe
• The Message Queuing service terminated unexpectedly
• Message Queuing service terminated
• Message Queuing service entered the stopped state
• Message Queuing service entered the running state
• Microsoft-Windows-WER-SystemErrorReporting
• Application Error
• Service Control Manager
• 0xc0000005

What your security team should do

• Inventory all Windows systems with Microsoft Message Queuing installed or running, prioritizing servers and systems reachable across network boundaries.
• Patch affected Windows versions promptly according to Microsoft guidance; treat exposed MSMQ systems as urgent because exploitation requires no authentication or user interaction.
• Immediately block inbound MSMQ traffic from untrusted networks, especially TCP/1801, and restrict access to known application peers.
• Disable or remove the MSMQ feature on systems where it is not business-critical.
• Hunt for recent crashes, restarts, or abnormal behavior involving mqsvc.exe and the Message Queuing service since publication on 2026-07-14.
• Add monitoring for unexpected inbound connections to MSMQ services, especially from workstations, VPN pools, internet sources, or non-application subnets.
• Review endpoint telemetry for suspicious child processes, command execution, or file writes associated with the MSMQ service process.
• Track vendor advisories, exploit-development chatter, and any KEV status change; escalate remediation urgency if public exploit code or active exploitation emerges.