Windows Message Queuing: Use-after-free allows local privilege escalation
Summary
Microsoft's Windows Message Queuing (MSMQ) component contains a use-after-free flaw (CWE-416) that allows an authorized local user to elevate privileges. An attacker needs a valid low-privileged account on the system, so this is a follow-on step after another compromise rather than a remote entry point. The CVSS vector rates the impact on confidentiality, integrity and availability as high. Microsoft published the CVE on 2026-11-10 and NVD analysis was still pending.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
- Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
- Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
- Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
- Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
- Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
- Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
Fixed in
Install the Microsoft cumulative update for November 2026 or later that brings each product to the fixed build or higher. Patch-level details and KB numbers: Unknown. Verify against the MSRC advisory.
Workaround
Unknown. No CVE-specific workaround has been published.
- As a general precaution, disable the Message Queuing service on hosts where MSMQ is not needed.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether MSMQ is installed (for example with Get-WindowsOptionalFeature or the Server Manager feature list).
- Install the November 2026 cumulative update on all affected hosts with MSMQ installed.
- Remove MSMQ from systems where it is not used.
- Replace or upgrade Windows versions that are no longer supported.
- Prioritize the remote MSMQ flaws published the same day over this local issue.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Message Queuing
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118126 msrc.microsoft.com
- CVE.org record CVE-2026-118126 www.cve.org
- Action1: Patch Tuesday November 2026 www.action1.com
- Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:03.
Original description (NVD)
Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.