CVE-2023-29363 Overview
CVE-2023-29363 is a remote code execution vulnerability in the Windows Pragmatic General Multicast (PGM) protocol implementation. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects Message Queuing services when PGM is enabled. An unauthenticated attacker can send a specially crafted file over the network to trigger remote code execution. No user interaction is required, and the attack complexity is low. The vulnerability spans nearly every supported Windows desktop and server release, making it a high-priority patching item for any environment running Microsoft Message Queuing (MSMQ) with multicast support.
Critical Impact
Unauthenticated attackers can achieve remote code execution on Windows systems running Message Queuing with PGM enabled by sending a crafted network payload.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022
Discovery Timeline
- 2023-06-14 - CVE-2023-29363 published to NVD
- 2025-04-08 - Last updated in NVD database
Technical Details for CVE-2023-29363
Vulnerability Analysis
The vulnerability resides in the Windows implementation of the Pragmatic General Multicast (PGM) protocol, which is delivered through the Microsoft Message Queuing (MSMQ) service. PGM provides reliable, ordered delivery for multicast traffic and is implemented in the rmcast.sys driver. The defect is a heap-based buffer overflow [CWE-122] triggered during the parsing of attacker-controlled multicast traffic. Successful exploitation grants execution at the privilege level of the vulnerable service component.
Root Cause
The root cause is improper validation of length or size fields within PGM packet structures before they are copied into a heap buffer. When the attacker-supplied size exceeds the destination allocation, adjacent heap metadata and objects are overwritten. Microsoft tracks this issue under the broader MSMQ/PGM hardening effort and provides remediation through the June 2023 Patch Tuesday cumulative updates.
Attack Vector
Exploitation requires the target system to have the Windows Message Queuing service installed and the PGM protocol enabled. Once enabled, MSMQ listens on TCP port 1801 and PGM traffic is processed through the multicast stack. An attacker on the network sends a crafted PGM packet to a reachable multicast group or directly to a vulnerable host. No authentication or user interaction is needed. Networks that expose MSMQ to untrusted segments or the internet face the highest risk, but lateral movement scenarios inside flat networks are equally viable.
No public proof-of-concept is referenced in the NVD entry. Refer to the Microsoft CVE-2023-29363 Advisory for vendor-provided technical context.
Detection Methods for CVE-2023-29363
Indicators of Compromise
- Unexpected inbound PGM traffic (IP protocol 113) directed at hosts running the Message Queuing service.
- Crashes or unexpected restarts of the MSMQ service or the rmcast.sys driver in the Windows Event Log.
- New child processes spawned by mqsvc.exe that do not match baseline behavior.
Detection Strategies
- Inventory all Windows hosts where the Message Queuing optional feature is installed and identify which have PGM multicast enabled.
- Monitor network telemetry for IP protocol 113 (PGM) flows, particularly from untrusted sources or across segmentation boundaries.
- Alert on anomalous process lineage from mqsvc.exe, including command interpreters, scripting hosts, or LOLBins.
Monitoring Recommendations
- Collect and correlate Windows System and Application logs for crashes referencing rmcast.sys or MSMQ components.
- Forward endpoint and network telemetry to a centralized analytics platform to baseline normal MSMQ behavior and flag deviations.
- Track exposure of TCP 1801 and the PGM multicast range at the firewall and switch layers to detect drift from policy.
How to Mitigate CVE-2023-29363
Immediate Actions Required
- Apply the June 2023 Microsoft security updates for every affected Windows desktop and server SKU listed in the advisory.
- Audit systems for the Message Queuing feature and remove it where not required for business operations.
- Block inbound TCP 1801 and PGM (IP protocol 113) traffic at perimeter and internal segmentation points.
Patch Information
Microsoft addressed CVE-2023-29363 in the June 2023 Patch Tuesday cumulative updates. Customers should consult the Microsoft CVE-2023-29363 Advisory for the specific KB articles that match each affected Windows build. Verify deployment status across all in-scope assets, including legacy server platforms such as Windows Server 2008 SP2 and 2008 R2 SP1, which receive updates through Extended Security Updates programs.
Workarounds
- Disable the Windows Message Queuing service (MSMQ) on systems that do not require it.
- Block TCP port 1801 inbound at host and network firewalls when MSMQ must remain installed.
- Restrict PGM multicast traffic through network ACLs so only trusted, business-justified endpoints can communicate.
# Configuration example - disable MSMQ and block PGM/MSMQ ports on Windows
Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
New-NetFirewallRule -DisplayName "Block MSMQ Inbound 1801" `
-Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block
New-NetFirewallRule -DisplayName "Block PGM Inbound" `
-Direction Inbound -Protocol 113 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
