CVE-2024-49118: Windows 10 1507 MSMQ RCE Vulnerability

CVE-2024-49118 Overview

CVE-2024-49118 is a remote code execution vulnerability affecting Microsoft Message Queuing (MSMQ), a Windows component that enables applications running on separate servers to communicate in a reliable and asynchronous manner. This vulnerability stems from a combination of race condition (CWE-362) and use-after-free (CWE-416) weaknesses within the MSMQ service, allowing unauthenticated attackers to execute arbitrary code on vulnerable systems over the network.

The vulnerability affects a broad range of Windows operating systems, spanning from legacy Windows Server 2008 to the latest Windows Server 2025 and Windows 11 24H2 releases. Organizations running MSMQ services exposed to the network are at significant risk, as successful exploitation could lead to complete system compromise.

Critical Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges on Windows systems running the MSMQ service.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 22H2, 24H2)
• Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025

Discovery Timeline

• 2024-12-12 - CVE-2024-49118 published to NVD
• 2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-49118

Vulnerability Analysis

This vulnerability resides within the Microsoft Message Queuing service (mqsvc.exe), which handles message queue operations for inter-process and inter-system communication. The flaw arises from improper synchronization when handling concurrent message processing operations, resulting in a race condition that can trigger a use-after-free memory corruption scenario.

When exploited, an attacker can manipulate the timing of specific MSMQ operations to cause the service to reference memory that has already been freed. This dangling pointer can then be leveraged to redirect execution flow to attacker-controlled code. The attack requires no authentication or user interaction, making it particularly dangerous for internet-facing MSMQ services.

The network-accessible nature of MSMQ (typically listening on TCP port 1801) combined with the high-complexity timing requirements for successful exploitation represents a nuanced but serious threat. While the attack complexity is high due to the race condition timing requirements, the potential impact is severe—successful exploitation grants SYSTEM-level code execution privileges.

Root Cause

The root cause involves two interrelated weaknesses. First, a race condition (CWE-362) occurs during concurrent access to shared message queue resources without proper synchronization primitives. Second, when the race condition is won by an attacker, a use-after-free condition (CWE-416) is triggered where the MSMQ service attempts to access a memory object that has been deallocated, allowing heap corruption and potential code execution.

Attack Vector

The attack is network-based and targets the MSMQ service, which listens on TCP port 1801 by default. An unauthenticated attacker on the network can send specially crafted messages designed to trigger the race condition. By carefully timing these requests, the attacker can cause the MSMQ service to process a freed memory object, potentially redirecting execution to malicious code.

The vulnerability is exploited by sending concurrent MSMQ protocol messages that create a timing window where the service accesses deallocated memory. The attacker must win the race condition by precisely timing the deallocation and subsequent access operations. Once successful, the attacker gains code execution in the context of the MSMQ service, which runs as SYSTEM.

Detection Methods for CVE-2024-49118

Indicators of Compromise

• Unusual crash events in the mqsvc.exe process documented in Windows Event Logs
• Unexpected network connections to TCP port 1801 from untrusted sources
• MSMQ service restarts without apparent cause, potentially indicating exploitation attempts
• Memory corruption artifacts in crash dumps associated with the Message Queuing service

Detection Strategies

• Monitor Windows Event Logs for Application Error events related to mqsvc.exe crashes
• Implement network intrusion detection rules for anomalous MSMQ traffic patterns on TCP port 1801
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process behavior spawned from MSMQ service context
• Analyze network traffic for high volumes of rapid MSMQ protocol requests that may indicate race condition exploitation attempts

Monitoring Recommendations

• Enable detailed auditing for the MSMQ service and monitor for service crashes or restarts
• Implement firewall logging for all connections to TCP port 1801 and review periodically
• Configure SentinelOne agents to monitor for suspicious child process creation from mqsvc.exe
• Establish baseline network behavior for MSMQ traffic and alert on deviations

How to Mitigate CVE-2024-49118

Immediate Actions Required

• Apply Microsoft security updates from the December 2024 Patch Tuesday release immediately
• If MSMQ is not required, disable the Message Queuing Windows feature
• Restrict network access to TCP port 1801 using host-based and network firewalls
• Segment MSMQ services away from untrusted network zones

Patch Information

Microsoft has released security updates addressing this vulnerability as part of the December 2024 Patch Tuesday. Detailed patch information and download links are available in the Microsoft Security Update Guide for CVE-2024-49118. Organizations should prioritize patching systems with MSMQ enabled, particularly those accessible from untrusted networks.

Workarounds

• Disable the Message Queuing Windows feature if not required for business operations
• Block inbound network connections to TCP port 1801 at perimeter and host-based firewalls
• Implement network segmentation to isolate systems running MSMQ from untrusted networks
• Consider using Windows Firewall rules to limit MSMQ access to specific trusted IP addresses only

# Disable MSMQ Windows feature via PowerShell
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart

# Block TCP port 1801 using Windows Firewall
netsh advfirewall firewall add rule name="Block MSMQ Port 1801" dir=in action=block protocol=TCP localport=1801