CVE-2023-28250 Overview
CVE-2023-28250 is a remote code execution vulnerability in the Windows Pragmatic General Multicast (PGM) protocol implementation. The flaw affects the Windows Message Queuing (MSMQ) service when PGM is enabled for multicast message delivery. An unauthenticated attacker can send specially crafted PGM packets across the network to trigger memory corruption and execute arbitrary code in the context of the service.
Microsoft assigned the issue to [CWE-191] (Integer Underflow). The vulnerability impacts all supported Windows client and server editions running the affected PGM component.
Critical Impact
Network-accessible attackers can achieve unauthenticated remote code execution on Windows hosts with MSMQ and PGM enabled.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022
Discovery Timeline
- 2023-04-11 - CVE-2023-28250 published to NVD as part of Microsoft's April 2023 Patch Tuesday
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-28250
Vulnerability Analysis
The vulnerability resides in the Windows implementation of Pragmatic General Multicast (PGM), a reliable multicast transport protocol used by the Microsoft Message Queuing (MSMQ) service. PGM is exposed when MSMQ is installed and configured to use multicast delivery, typically binding to TCP port 1801 and PGM-specific endpoints.
An unauthenticated remote attacker can send crafted PGM datagrams to a vulnerable host. Improper validation of length or size fields during packet processing leads to memory corruption inside the service. Successful exploitation grants code execution in the security context of the MSMQ service.
The attack requires no privileges and no user interaction. Exposure is limited to systems where the Message Queuing feature is installed, since PGM ships with MSMQ rather than as a default Windows component.
Root Cause
The root cause is an integer underflow [CWE-191] in the PGM packet parsing logic. When a malformed length or offset field is processed, the resulting arithmetic produces a value that bypasses bounds checks and is used to index or copy attacker-controlled data into a buffer that is too small.
Attack Vector
Exploitation occurs over the network without authentication. The attacker targets a host running MSMQ with PGM enabled and reachable on the network. Crafted multicast or unicast PGM packets sent to the listening service trigger the underflow and subsequent memory corruption.
No verified public proof-of-concept code is referenced in the NVD entry, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical specifics, refer to the Microsoft CVE-2023-28250 Advisory.
Detection Methods for CVE-2023-28250
Indicators of Compromise
- Unexpected mqsvc.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the Message Queuing service.
- Crashes or repeated restarts of the MSMQ service, recorded under Application or System event logs with faulting module references to PGM components.
- Inbound network traffic to TCP port 1801 or PGM multicast traffic (IP protocol 113) from untrusted sources.
Detection Strategies
- Hunt for anomalous process lineage where mqsvc.exe is the parent of interactive shells, scripting interpreters, or LOLBins.
- Monitor for outbound connections initiated by mqsvc.exe to non-MSMQ peers, which would indicate post-exploitation activity.
- Correlate MSMQ service crashes with subsequent suspicious authentication or lateral movement events on the same host.
Monitoring Recommendations
- Inventory all hosts with the Message Queuing Windows feature installed and verify patch level against the April 2023 Microsoft security update.
- Enable network telemetry for TCP port 1801 and PGM traffic, and alert on PGM packets originating outside expected application segments.
- Forward Windows Application, System, and Sysmon process-creation logs to a centralized SIEM for behavioral analytics on MSMQ activity.
How to Mitigate CVE-2023-28250
Immediate Actions Required
- Apply the April 2023 Microsoft security updates that address CVE-2023-28250 on all affected Windows client and server systems.
- Identify hosts with MSMQ installed using Get-WindowsFeature MSMQ or Get-Service MSMQ, and prioritize patching those systems.
- Block inbound TCP port 1801 and PGM multicast traffic at the perimeter and on host firewalls where MSMQ is not required.
Patch Information
Microsoft released security updates for all affected Windows versions on April 11, 2023. Refer to the Microsoft CVE-2023-28250 Advisory for the specific KB articles applicable to each supported Windows build.
Workarounds
- Uninstall the Message Queuing (MSMQ) Windows feature on systems that do not require it.
- Disable PGM multicast support where MSMQ is needed but multicast delivery is not, eliminating the vulnerable code path.
- Restrict access to TCP port 1801 to known MSMQ peers using Windows Defender Firewall or network segmentation.
# Check whether the Message Queuing service is installed and running
Get-Service -Name MSMQ -ErrorAction SilentlyContinue
# Remove the MSMQ feature if it is not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Container -Remove
# Block inbound TCP 1801 on hosts that must keep MSMQ but do not need remote queues
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
