Windows Message Queuing: Use-after-free enables local privilege escalation

Summary

Windows Message Queuing (MSMQ), an optional Windows component, contains a use-after-free flaw that allows an authorized local user to elevate privileges. An attacker needs a valid local account or existing code execution, and the attack is not possible remotely. Successful exploitation could give full control over the affected system, so the risk is highest on servers and multi-user systems where MSMQ is installed.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2 (builds below 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846 and 10.0.19045.7846)
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (builds listed in the CVE record; 24H2, 25H2 and 26H1 not confirmed by the second source)
• Windows Server 2016, 2019 and 2022, including Server Core installations (builds below 10.0.14393.9688, 10.0.17763.9487 and 10.0.20348.5870)
• Windows Server 2025 is listed by a third-party aggregator only; verify on MSRC
• The complete build list must be confirmed on the MSRC advisory page; the CVE record text was truncated

Fixed in

• Fixed in the November 2026 security updates (builds per the CVE record listed under Affected)
• The specific KB number could not be confirmed; check the MSRC advisory for the KB and final build list

Workaround

• No vendor workaround found; the MSRC page could not be checked
• If MSMQ is not needed, disable the feature via Turn Windows features on or off (Microsoft Message Queue (MSMQ) Server) or stop and disable the MSMQ service; this breaks MSMQ-dependent applications
• Limit local logons and run users with standard user rights to reduce the risk

Exploitation

• No evidence found of in-the-wild exploitation, public proof of concept or CISA KEV listing; this is an absence of findings, not confirmed absence
• CISA SSVC: exploitation none, automatable no, technical impact total
• CVSS temporal vector E:U (exploit code maturity Unproven)

Our recommendation

• Identify hosts with MSMQ installed, starting with servers and shared multi-user systems
• Install the November 2026 cumulative update after confirming the KB and build on the MSRC page
• Disable MSMQ on systems where it is not needed
• Recheck the NVD entry and CISA KEV once analysis is published

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-118125 msrc.microsoft.com
• CVE.org record CVE-2026-118125 www.cve.org
• Strix.ai: CVE-2026-118125 (affected builds, third party) www.strix.ai
• Senserva: KB5131090 (third party, does not name this CVE) senserva.com
• Windows News: CVE-2026-33838 MSMQ privilege escalation and optional feature risks windowsnews.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:56.