CVE-2023-35385 Overview
CVE-2023-35385 is a remote code execution vulnerability in the Microsoft Message Queuing (MSMQ) service. The flaw is rooted in an integer overflow condition [CWE-190] within MSMQ message handling. An unauthenticated attacker can send a specially crafted malicious MQTT packet to a server running the MSMQ service and trigger remote code execution in the context of the service.
MSMQ listens on TCP port 1801 by default. When enabled, the service exposes a network-reachable attack surface that does not require authentication or user interaction, which makes this vulnerability suitable for worm-style propagation across enterprise networks.
Critical Impact
Unauthenticated network attackers can execute arbitrary code on Windows hosts running the MSMQ service, leading to full system compromise across multiple Windows client and server versions.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022
Discovery Timeline
- 2023-08-08 - CVE-2023-35385 published to NVD by Microsoft as part of the August 2023 Patch Tuesday release
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-35385
Vulnerability Analysis
The vulnerability resides in the Windows Message Queuing service (mqsvc.exe), a legacy messaging component used for asynchronous communication between distributed applications. MSMQ processes packets that follow proprietary binary protocol structures, and the service has historically suffered from parser issues, including CVE-2023-21554 (QueueJumper) earlier in the same year.
Microsoft classifies CVE-2023-35385 as a remote code execution issue mapped to [CWE-190] Integer Overflow or Wraparound. Successful exploitation grants the attacker code execution within the security context of the MSMQ service, which typically runs with elevated privileges on the host.
The attack does not require credentials, user interaction, or local access. Any Windows system with the Message Queuing feature enabled and reachable over the network is at risk.
Root Cause
The root cause is an integer overflow in MSMQ packet parsing logic. When the service processes attacker-controlled length or count fields, an arithmetic operation wraps around the integer boundary. This produces an undersized memory allocation or incorrect bounds check that is subsequently used to copy attacker-controlled data, resulting in memory corruption that can be steered toward code execution.
Attack Vector
Exploitation occurs over the network against TCP port 1801, the default MSMQ listening port. The attacker sends a crafted MSMQ packet that triggers the integer overflow during parsing. Because the Message Queuing service starts automatically when the feature is installed, no user activity on the target is required. Refer to the Microsoft Vulnerability Advisory for vendor technical details.
No public proof-of-concept exploit is referenced in the enriched CVE data.
The vulnerability is described in prose based on Microsoft's advisory
and the assigned CWE-190 (Integer Overflow) classification.
Detection Methods for CVE-2023-35385
Indicators of Compromise
- Unexpected inbound TCP connections to port 1801 from untrusted networks or external hosts
- Crashes, restarts, or abnormal memory usage in the mqsvc.exe process
- Child processes spawned by mqsvc.exe that are not associated with normal MSMQ operations
- Outbound network connections originating from mqsvc.exe to attacker-controlled infrastructure
Detection Strategies
- Inventory all Windows hosts with the Message Queuing feature installed and correlate against patch status for the August 2023 cumulative update
- Inspect network telemetry for TCP/1801 traffic crossing network segmentation boundaries
- Hunt for process lineage anomalies where mqsvc.exe is the parent of cmd.exe, powershell.exe, or other living-off-the-land binaries
- Monitor Windows Error Reporting and Application event logs for repeated MSMQ service faults that may indicate exploitation attempts
Monitoring Recommendations
- Enable command-line and process creation auditing (Event ID 4688) on hosts running MSMQ
- Forward MSMQ-related Windows Event Log channels to a centralized SIEM for retention and correlation
- Apply IDS/IPS signatures for known MSMQ exploitation patterns at network egress and segmentation points
How to Mitigate CVE-2023-35385
Immediate Actions Required
- Apply the August 2023 Microsoft security update for all affected Windows client and server versions listed in the Microsoft Vulnerability Advisory
- Audit all systems for the presence of the Message Queuing feature using Get-WindowsFeature MSMQ or Get-Service MSMQ
- Disable the Message Queuing service on hosts where it is not required for business operations
- Block inbound TCP/1801 at perimeter firewalls and restrict it to required hosts via host-based firewall rules
Patch Information
Microsoft addressed CVE-2023-35385 in the August 2023 Patch Tuesday release. Administrators should consult the Microsoft Vulnerability Advisory for the specific KB articles applicable to each Windows build, then deploy through Windows Update, WSUS, or Microsoft Endpoint Configuration Manager.
Workarounds
- Uninstall the Message Queuing Windows feature on systems that do not require MSMQ
- Stop and disable the MSMQ service where the feature must remain installed but is not in active use
- Restrict TCP/1801 to a defined allowlist of trusted application servers using Windows Defender Firewall or network ACLs
# Verify MSMQ status and disable if not required (run in elevated PowerShell)
Get-Service -Name MSMQ
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled
# Block inbound TCP/1801 at the host firewall
New-NetFirewallRule -DisplayName "Block MSMQ Inbound 1801" `
-Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
