Microsoft Patches New MSMQ RCE and Privilege Escalation Flaws

Microsoft disclosed two new vulnerabilities in Windows Message Queuing (MSMQ): CVE-2026-34329, a heap-based buffer overflow that can let an unauthorized attacker on an adjacent network send a specially crafted MSMQ message and achieve remote code execution, and CVE-2026-33838, a double-free flaw that can allow a local low-privileged attacker to gain SYSTEM privileges. Microsoft rated both issues Important, assigned CVSS scores of 8.8 and 7.8 respectively, said neither was publicly disclosed or exploited in the wild at publication, and released fixes for both vulnerabilities. Microsoft credited Azure Yang (@4zure9) of Kunlun Lab with reporting CVE-2026-34329.

The disclosures add to a longer pattern of serious MSMQ security issues previously tracked by Microsoft, including CVE-2023-21554 and multiple 2023 MSMQ remote code execution bugs such as CVE-2023-36572, CVE-2023-36575, CVE-2023-36578, CVE-2023-36583, CVE-2023-36589, and CVE-2023-36590. The repeated appearance of MSMQ flaws across releases underscores the continued risk posed by the legacy Windows messaging component, particularly where the service is enabled and reachable from adjacent networks or accessible to local users.