CVE-2026-54992

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Message Queuing Queue Manager component. A local, unauthenticated attacker who can interact with the local MSMQ service could send malformed input that corrupts heap memory and redirects execution flow. Successful exploitation can result in arbitrary code execution in the context of the Message Queuing service, potentially enabling full confidentiality, integrity, and availability compromise of the affected Windows system. Exposure is most relevant on systems where Microsoft Message Queuing is installed and the Queue Manager service is enabled.

Why it matters to the business

If exploited, this flaw could allow a local attacker or malware already present on a Windows workstation or server to gain powerful execution on the system, disable services, access sensitive data, install persistence, or move further into the environment. Because the affected product set spans many supported Windows client and server versions, organizations using MSMQ-dependent applications may have broad exposure. The vulnerability has a high CVSS score, but it is not currently listed in CISA KEV, has low EPSS, and has no reported public exploit maturity in the provided data, so remediation should be prioritized based on MSMQ usage, server criticality, and exposure to untrusted local users or workloads.

How an attack unfolds

An attacker first obtains the ability to run code locally on an affected Windows system, for example through a low-privileged shell, malicious local user session, compromised application account, or previously deployed malware. The attacker then determines whether Microsoft Message Queuing is installed and whether the Queue Manager service is running. If available, the attacker interacts with the local MSMQ interfaces and submits specially crafted data that triggers a heap overflow in Queue Manager processing. The malformed input corrupts process memory and, if the attacker successfully controls execution flow, causes attacker-supplied code to execute under the MSMQ service context. The attacker can then use that execution to run commands, drop additional payloads, create persistence, tamper with queues or applications that depend on MSMQ, dump credentials accessible to the compromised context, or pivot to other systems.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for each affected Windows release, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build or package versions were provided in the input, so remediation should be verified against the official Microsoft update guidance for the relevant OS build. Where MSMQ is not required, remove or disable the Microsoft Message Queuing feature and stop/disable the Message Queuing service. Where MSMQ is required, restrict local access to systems that need it, harden service permissions, reduce interactive logon rights, limit untrusted local code execution, and monitor the MSMQ service closely until patching is complete. Prioritize servers that process business-critical queues, multi-user systems, terminal servers, developer workstations, build agents, and systems where untrusted workloads can execute locally.

How to confirm the fix worked

Confirm whether Microsoft Message Queuing is installed and running on affected Windows systems. Validate that the applicable Microsoft security update has been installed for the exact Windows build and that the system has been rebooted if required. Where MSMQ is not needed, confirm the feature is removed or the service is disabled and cannot be started by unprivileged users. Where MSMQ remains enabled, verify that the service is running the patched binaries, review the Windows update history, and check that vulnerability scanners no longer report the host as affected. Administrators can also validate exposure by checking for the Message Queuing service, the mqsvc.exe process, and installed MSMQ optional features across Windows assets.

Typical attack path

1. Gain local code execution or an interactive session on an affected Windows client or server.
2. Check whether Microsoft Message Queuing is installed and whether the MSMQ / Message Queuing service is running.
3. Craft malformed MSMQ input intended to trigger heap corruption in the Queue Manager component.
4. Deliver the malformed input through local MSMQ interfaces or APIs.
5. Achieve code execution in the Message Queuing service context if heap exploitation succeeds.
6. Spawn a command interpreter or loader, deploy follow-on payloads, escalate control, or establish persistence.
7. Cover tracks by removing temporary exploit artifacts and blending activity with normal service behavior.

How to detect it

To determine whether this was already exploited, focus on host telemetry around the Microsoft Message Queuing service. Review Windows System logs for unexpected Message Queuing service crashes, restarts, or service control events, especially Service Control Manager events 7031, 7034, and 7036. Review Application logs and Windows Error Reporting for crashes of mqsvc.exe, heap corruption, access violations, or repeated faulting events. In EDR or Sysmon telemetry, hunt for mqsvc.exe spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or other LOLBins; MSMQ service processes normally should not launch interactive shells or script interpreters. Correlate any mqsvc.exe crash with subsequent file creation, scheduled task creation, new service installation, registry Run key modification, credential dumping, or outbound network connections. Because no public exploit maturity or named threat actors were provided, detections should emphasize behavioral evidence rather than fixed exploit signatures.

• mqsvc.exe
• Message Queuing
• MSMQ
• Faulting application name: mqsvc.exe
• Faulting module name: mqsvc.exe
• Service Control Manager event ID 7031
• Service Control Manager event ID 7034
• The Message Queuing service terminated unexpectedly
• The Message Queuing service entered the stopped state
• The Message Queuing service entered the running state
• Windows Error Reporting event ID 1001
• Application Error event ID 1000
• mqsvc.exe -> cmd.exe
• mqsvc.exe -> powershell.exe
• mqsvc.exe -> wscript.exe
• mqsvc.exe -> cscript.exe
• mqsvc.exe -> mshta.exe
• mqsvc.exe -> rundll32.exe
• mqsvc.exe -> regsvr32.exe
• mqsvc.exe -> certutil.exe
• mqsvc.exe -> bitsadmin.exe
• C:\Windows\System32\mqsvc.exe
• C:\Windows\SysWOW64\mqsvc.exe

What your security team should do

• Inventory Windows systems with Microsoft Message Queuing installed or the Message Queuing service running.
• Prioritize patching of MSMQ-enabled servers, multi-user Windows systems, and systems that allow local execution by untrusted users or applications.
• Apply the relevant Microsoft security update for each affected Windows version and confirm reboot completion where required.
• Disable or remove Microsoft Message Queuing wherever there is no business dependency.
• Add detection for mqsvc.exe crashes, unexpected child processes spawned by mqsvc.exe, and suspicious local interaction with MSMQ components.
• Hunt for post-exploitation behavior such as new local users, scheduled tasks, services, credential dumping tools, and unusual PowerShell or command interpreter activity following MSMQ service faults.
• Treat exploitation as a likely local privilege escalation or local code-execution event and perform host-level containment if suspicious MSMQ activity is observed.