Loading vulnerability…
Remote Code Execution in Windows Message Queuing
CVE-2026-34329 is a heap-based buffer overflow vulnerability in Microsoft Windows Message Queuing (MSMQ). The flaw is triggered when the MSMQ service processes a specially crafted inbound queue message and fails to properly validate message data before writing beyond a heap-allocated buffer. This memory corruption condition can overwrite adjacent heap structures and redirect execution flow, allowing arbitrary code execution in the context of the MSMQ service process. The vulnerability is reachable over an adjacent network and does not require authentication or user interaction. Affected systems are supported Windows client and server platforms where MSMQ is installed and actively running.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in full remote code execution on the target system, with high impact to confidentiality, integrity, and availability. An attacker could execute arbitrary code in the context of the MSMQ service, potentially leading to complete system compromise, follow-on lateral movement within internal environments, persistence, and access to or exfiltration of sensitive data. Because exploitation is unauthenticated and requires only adjacent network access, the vulnerability presents a significant risk in flat or poorly segmented enterprise networks.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling MSMQ on systems where it is not required, restricting access to the MSMQ service through network segmentation and host-based or perimeter firewall controls, and limiting adjacent-network reachability to trusted systems only. Monitoring for unexpected MSMQ-related network activity and service exposure can help identify potentially vulnerable or targeted hosts until patches are fully deployed.
Patch, then assume compromise.
Apply the Microsoft security updates released on 2026-05-12 for affected Windows products. Microsoft provided an official fix through cumulative and security updates that correct how MSMQ validates and handles incoming message data, preventing the heap overflow condition. Priority should be given to systems with MSMQ enabled and exposed to adjacent network segments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.