Microsoft Windows Message Queuing: Remote code execution via use-after-free

Summary

Windows Message Queuing (MSMQ) Queue Manager in several supported Windows client and server versions contains a use-after-free flaw (CWE-416). An unauthenticated attacker with network access to the MSMQ service can execute code remotely, and the CVSS base score is 9.8 (critical). MSMQ is not installed by default, so exposure depends on whether it is installed and reachable over the network (by default TCP/1801).

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: 10.0.19044.0 to before 10.0.19044.7807 and 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2, 24H2, 25H2 and 26H1/26H2: see the MSRC advisory for the exact build ranges
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 / Server 2016: 10.0.14393.9612 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Other versions: security update of October 13, 2026 (see MSRC for build numbers)
• A restart is required after installation

Workaround

• Disable the MSMQ service or the MSMQ-Server Windows feature on hosts that do not need it, after checking application dependencies
• Block TCP/1801 at the perimeter and between network segments where MSMQ is still required

Exploitation

• Microsoft assesses exploitation as less likely and states the vulnerability has not been publicly disclosed or exploited.
• No public proof-of-concept code was found in the sources.
• Sources conflict on whether the CVE is listed in the CISA KEV catalog; this is unresolved and must be checked directly in the catalog.
• Exploitability is rated as automatable by CISA SSVC, and no authentication is required.

Our recommendation

• Patch all hosts with MSMQ installed as a priority, and update all other affected Windows systems in the regular cycle.
• Identify hosts with the MSMQ feature or service running and check whether legacy applications depend on it.
• Disable MSMQ where it is not needed and block TCP/1801 from untrusted networks.
• Verify the affected build numbers against the MSRC version table and check the Windows 10 1607 lifecycle or ESU status.
• Monitor for unusual MSMQ traffic and for updates on KEV status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-100202 msrc.microsoft.com
• Microsoft MSRC Advisory CVE-2026-100202 msrc.microsoft.com
• Action1: Patch Tuesday October 2026 www.action1.com
• CCB Belgium: Microsoft Patch Tuesday October 2026 warning ccb.belgium.be
• CrowdStrike: Patch Tuesday analysis October 2026 www.crowdstrike.com
• Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:01.