Loading vulnerability…
Windows Message Queuing Double Free Local Privilege Escalation
CVE-2026-33838 is a local elevation-of-privilege vulnerability in Microsoft Windows Message Queuing (MSMQ). The flaw is a double-free memory corruption issue, classified as CWE-415, and has been described as occurring within the mqac.sys driver. The vulnerable condition stems from improper handling of object lifetime, where the implementation can perform additional free operations on an object whose existence has not been properly validated. An authenticated local attacker with the ability to execute low-privileged code on a system where MSMQ is installed and enabled can exploit the flaw to elevate privileges. Available reporting indicates successful exploitation may result in arbitrary code execution in kernel context, which in turn enables escalation to SYSTEM on the affected host.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can give an attacker SYSTEM-level privileges on the local machine. Because the flaw may permit arbitrary code execution in kernel context, the resulting impact is effectively full compromise of the affected system, including high impact to confidentiality, integrity, and availability. In practical post-compromise scenarios, this level of access can support persistence, credential theft, defense evasion, and lateral movement.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling or removing the Windows Message Queuing feature on systems that do not require it, and restrict local code execution opportunities for untrusted or low-privileged users. Because this is a local post-compromise privilege-escalation issue, hardening measures that limit interactive access, application execution, and unnecessary MSMQ deployment can reduce risk until the official fix is applied. No separate vendor workaround beyond applying the security update is currently available.
Patch, then assume compromise.
Apply the Microsoft security updates released on 2026-05-12 for affected Windows client and server platforms. Microsoft distributed fixes through standard update channels including Windows Update, WSUS, and the Microsoft Update Catalog. On legacy Windows Server 2012 and 2012 R2 systems under ESU, the latest required servicing stack update must be installed before applying the security update. Customer action is required on affected platforms.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.