CVE-2024-26208: Windows 10 1507 MSMQ RCE Vulnerability

CVE-2024-26208 Overview

CVE-2024-26208 is a remote code execution vulnerability in Microsoft Message Queuing (MSMQ), the messaging protocol service bundled with Windows client and server operating systems. The flaw is tracked under [CWE-191] (Integer Underflow) and impacts systems where the MSMQ service is enabled. An authenticated attacker with high privileges can send crafted messages over the network to trigger code execution in the context of the MSMQ service. Microsoft addressed the issue in its April 2024 security updates. The affected footprint spans more than two decades of Windows releases, from Windows Server 2008 through Windows Server 2022 23H2 and Windows 10/11 client editions.

Critical Impact
Successful exploitation grants remote code execution on hosts running the MSMQ service, compromising confidentiality, integrity, and availability of the target system.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2
Any of the above with the Message Queuing (MSMQ) role or feature enabled

Discovery Timeline

2024-04-09 - CVE-2024-26208 published to NVD alongside Microsoft's April 2024 Patch Tuesday release
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26208

Vulnerability Analysis

The vulnerability resides in the MSMQ service, which listens on TCP port 1801 by default when the Message Queuing feature is installed. MSMQ processes messages using its own binary protocol and internally parses length fields, offsets, and property structures. The [CWE-191] classification indicates that an integer underflow occurs during this parsing, producing a value smaller than expected and leading to unsafe memory operations. The attacker must already hold high privileges on the target, which places the flaw in the post-authentication remote code execution category rather than an unauthenticated worm-style bug like CVE-2023-21554 (QueueJumper).

Root Cause

An integer underflow ([CWE-191]) in MSMQ's message parsing logic allows a length or size calculation to wrap below zero. The resulting value is then used to reference memory outside the intended bounds, corrupting service state and enabling attacker-controlled execution flow inside the MSMQ service process.

Attack Vector

The attack vector is network-based. An attacker sends a crafted MSMQ message to the listening service, typically on TCP 1801, and the malformed length field triggers the underflow during deserialization. Because the attack requires high privileges, exploitation is most realistic as a lateral movement or privilege-consolidation step after initial access, rather than for perimeter breach.

No verified public proof-of-concept code is available for CVE-2024-26208. Refer to the Microsoft CVE-2024-26208 Guide for authoritative technical details.

Detection Methods for CVE-2024-26208

Indicators of Compromise

Unexpected inbound TCP connections to port 1801 on servers or workstations that do not normally host queues
Crashes, restarts, or access violations of the mqsvc.exe process recorded in the Windows Application or System event logs
Child processes spawned by mqsvc.exe (for example cmd.exe, powershell.exe, or rundll32.exe), which is highly unusual for the MSMQ service

Detection Strategies

Inventory all hosts where the Message Queuing feature is installed using Get-WindowsFeature MSMQ or equivalent configuration management queries
Alert on process-tree anomalies where mqsvc.exe launches interactive shells or scripting hosts
Correlate MSMQ service crashes with subsequent authentication or lateral movement events on the same host

Monitoring Recommendations

Log and review all network traffic to TCP 1801 at perimeter and internal segmentation points
Enable Windows Defender Application Control or Attack Surface Reduction rules that restrict child-process creation from service accounts
Forward MSMQ-related events and endpoint telemetry to a centralized SIEM for retention and correlation

How to Mitigate CVE-2024-26208

Immediate Actions Required

Apply the April 2024 Microsoft security updates to every affected Windows client and server build
Audit hosts for the Message Queuing feature and remove it where it is not required for business functions
Restrict inbound access to TCP 1801 to only the specific application servers that must communicate over MSMQ

Patch Information

Microsoft released fixes for CVE-2024-26208 as part of the April 9, 2024 security update cycle. Patch identifiers and download links for each affected Windows build are listed in the Microsoft CVE-2024-26208 Guide. Systems that are current with cumulative updates released after April 2024 are protected.

Workarounds

Disable the Message Queuing service on hosts that do not use it: Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Container
Block TCP port 1801 at the host firewall and network boundary for hosts that must retain MSMQ locally but do not require remote access
Enforce strict authentication and network segmentation so that only trusted, high-privileged accounts can reach MSMQ endpoints

bash

# Check whether MSMQ is installed and stop the service if not required
Get-Service MSMQ
Stop-Service MSMQ -Force
Set-Service MSMQ -StartupType Disabled

# Block inbound MSMQ traffic at the Windows firewall
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" `
  -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block