Windows Message Queuing: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in Windows Message Queuing (MSMQ) allows an unauthenticated attacker on the network to execute code. The CNA record rates the attack complexity as high, so the attack requires specific conditions. MSMQ is an optional Windows feature, so systems without it installed are not affected.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846, per secondary source)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Windows Server 2025: fixed build 10.0.26100.33822 per secondary source only, unverified

Fixed in

Fixed in Microsoft's November 2026 security updates. Install the update for the affected builds listed above. Verify the exact fixed builds on the MSRC page, because the CNA record truncates the Windows 10 22H2 entry and the Server builds come from a secondary source.

Workaround

• No Microsoft-issued workaround found.
• Disable the MSMQ feature if it is not needed. Uninstalling MSMQ deletes all existing queues and queue configuration, so check dependencies first. A reboot is required.
• General hardening, not confirmed by Microsoft for this CVE: block inbound TCP 1801 at the perimeter and on untrusted network segments.

Exploitation

• No evidence of exploitation in the wild found. The CISA SSVC assessment lists Exploitation: none and Automatable: no.
• No public proof of concept found.
• NVD is still awaiting analysis, so this status may change.

Our recommendation

• Install the November 2026 security updates on all Windows hosts, starting with internet-facing servers and systems reachable from untrusted segments.
• Check whether MSMQ is installed and running, especially on legacy .NET application servers, BizTalk hosts and older workstations.
• Disable MSMQ on hosts where it is not needed.
• Where MSMQ must stay active, restrict TCP 1801 to required sources only.
• Confirm exposure and fixed builds against the MSRC advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-116710 msrc.microsoft.com
• CVE Record CVE-2026-116710 (Microsoft CNA) www.cve.org
• ZDI: The November 2026 Security Update Review www.thezdi.com
• Strix: CVE-2026-116710 (secondary, build details unverified) www.strix.ai
• Automox: Mitigating MSMQ RCE on Windows www.automox.com
• PentestPad: Port 1801 MSMQ www.pentestpad.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:44.