Windows Message Queuing: Remote code execution due to double free
Summary
A double free vulnerability (CWE-415) in Windows Message Queuing (MSMQ) allows an unauthenticated attacker to execute code over the network. Exploitation is rated high complexity, and the CVSS base score is 8.1 according to the CNA. The flaw only matters on systems where MSMQ is installed and reachable from untrusted networks.
Affected
- Windows 10 Version 1607, 1809, 21H2, 22H2
- Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
- Windows Server 2016, 2019, 2022 (including Server Core installations)
Sources differ on some products (for example Windows 11 24H2/25H2 and Windows Server 2025). Check the MSRC advisory for the final list.
Fixed in
- Fixed in the November 2026 security update.
- Fixed builds per CNA record: 10.0.14393.9688 (Windows 10 1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1).
Verify the KB numbers for each build on MSRC.
Workaround
- No vendor-confirmed workaround.
- Interim measures, not confirmed by Microsoft: disable MSMQ if it is not needed; if it is needed, block its network ports at the perimeter and between network segments. Test before rollout.
Exploitation
- No known in-the-wild exploitation (Rapid7, Senserva).
- CISA SSVC: exploitation none, not automatable, technical impact total.
- No public proof of concept found.
Our recommendation
- Inventory Windows hosts and check whether MSMQ is installed and listening.
- Patch with the November 2026 update first on internet-facing servers and servers close to domain controllers.
- Disable MSMQ where it is not needed; where it is needed, block its ports from untrusted networks.
- Re-check the MSRC advisory and NVD, since NVD status was Awaiting Analysis at publication.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Critical
- Impact
- Remote code execution – Windows Message Queuing
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- CVE.org CVE Record www.cve.org
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Senserva KB 5132061 senserva.com
- Qualys Patch Tuesday November 2026 review blog.qualys.com
- Zero Day Initiative November 2026 security update review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:38.
Original description (NVD)
Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.