Loading story…
Microsoft disclosed two new vulnerabilities in Windows Message Queuing (MSMQ): CVE-2026-34329, a heap-based buffer overflow that can let an unauthorized attacker on an adjacent network send a specially crafted MSMQ message and achieve remote code execution, and CVE-2026-33838, a double-free flaw that can allow a local low-privileged attacker to gain SYSTEM privileges. Microsoft rated both issues Important, assigned CVSS scores of 8.8 and 7.8 respectively, said neither was publicly disclosed or exploited in the wild at publication, and released fixes for both vulnerabilities. Microsoft credited Azure Yang (@4zure9) of Kunlun Lab with reporting CVE-2026-34329.
The disclosures add to a longer pattern of serious MSMQ security issues previously tracked by Microsoft, including CVE-2023-21554 and multiple 2023 MSMQ remote code execution bugs such as CVE-2023-36572, CVE-2023-36575, CVE-2023-36578, CVE-2023-36583, CVE-2023-36589, and CVE-2023-36590. The repeated appearance of MSMQ flaws across releases underscores the continued risk posed by the legacy Windows messaging component, particularly where the service is enabled and reachable from adjacent networks or accessible to local users.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-34329, an Important MSMQ remote code execution vulnerability caused by a heap-based buffer overflow and rated CVSS 8.8. Microsoft said the bug was not publicly disclosed or exploited in the wild at publication, released a fix, and credited Azure Yang of Kunlun Lab for reporting it.
Microsoft disclosed CVE-2026-33838, an Important Windows Message Queuing elevation-of-privilege vulnerability caused by a double-free weakness. The company said local attackers with low privileges could potentially gain SYSTEM privileges, and that a fix was available at publication.
Microsoft published Security Update Guide entries for several MSMQ remote code execution vulnerabilities, including CVE-2023-36572, CVE-2023-36575, CVE-2023-36578, CVE-2023-36583, CVE-2023-36589, and CVE-2023-36590. These entries show a coordinated October 2023 disclosure and patch release affecting MSMQ.
Microsoft published a Security Update Guide entry for CVE-2023-21554, identifying a remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The disclosure indicates a security update was issued as part of Microsoft's April 2023 release cycle.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for **Microsoft Message Queuing (MSMQ)** to address three disclosed vulnerabilities affecting the Windows messaging component. The issues include **`CVE-2024-49122`**, a **remote code execution** flaw, alongside **`CVE-2025-21181`** and **`CVE-2025-21289`**, both classified as **denial-of-service** vulnerabilities in MSMQ. The advisories indicate that organizations running systems with MSMQ enabled should review Microsoft's Security Update Guide entries and apply the relevant patches to reduce the risk of service disruption or potential code execution. The combination of one RCE bug and two DoS flaws highlights continued security exposure in MSMQ, a legacy Windows feature that may remain active in enterprise environments even when it is not widely used.
Jul 12, 2026
Microsoft disclosed and patched two denial-of-service flaws in **Microsoft Message Queuing (MSMQ)**, tracked as **`CVE-2023-28302`** and **`CVE-2023-36606`**, through its Security Update Guide. Both issues affect the Windows messaging component and could allow an attacker to disrupt service availability on systems where MSMQ is enabled. The vulnerabilities were published in separate Microsoft advisories and add to the security risk surrounding exposed or unnecessary MSMQ deployments. Organizations using MSMQ should review Microsoft’s guidance, apply the relevant security updates, and verify whether the service is required on internet-facing or internal systems to reduce the likelihood of service disruption.
Jul 12, 2026
Microsoft disclosed and patched a cluster of **Microsoft Message Queuing (MSMQ)** denial-of-service vulnerabilities affecting Windows systems, including `CVE-2025-21230`, `CVE-2025-21290`, `CVE-2025-21270`, `CVE-2025-21289`, and `CVE-2025-21251`. The issues were published through the Microsoft Security Response Center update guide and all identify MSMQ as the affected component, indicating that specially crafted traffic or message handling conditions could disrupt the service and impact application availability on systems where MSMQ is enabled. The January disclosures followed an earlier MSMQ denial-of-service issue, `CVE-2024-49096`, showing continued security attention on the legacy messaging component across consecutive update cycles. Organizations using MSMQ should prioritize applying Microsoft security updates, verify whether the service is enabled on exposed or business-critical hosts, and assess operational dependencies because repeated flaws in the component raise the risk of service interruption if unpatched systems remain reachable.
Jul 12, 2026