CVE-2024-49122: Windows 10 1507 MSMQ RCE Vulnerability

CVE-2024-49122 Overview

CVE-2024-49122 is a remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The flaw stems from a use-after-free condition ([CWE-416]) combined with a race condition ([CWE-362]) in the MSMQ service. An unauthenticated attacker can send specially crafted malicious packets to an MSMQ server over the network to execute arbitrary code in the context of the service. The vulnerability affects every supported Windows client and server release that has the Message Queuing feature enabled. Microsoft addressed the issue in the December 2024 Patch Tuesday update.

Critical Impact
Successful exploitation grants remote code execution on affected Windows hosts without authentication or user interaction, exposing systems that expose TCP port 1801 to compromise.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Any of the above with the Message Queuing (MSMQ) Windows feature installed and enabled

Discovery Timeline

2024-12-12 - CVE-2024-49122 published to the National Vulnerability Database
2024-12-12 - Microsoft released a security update addressing the vulnerability
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-49122

Vulnerability Analysis

The vulnerability resides in the Microsoft Message Queuing service (mqsvc.exe), a component used for asynchronous messaging between Windows applications. MSMQ listens on TCP port 1801 by default and processes binary protocol messages from remote clients. An attacker who can reach this port can trigger a memory corruption condition that leads to code execution within the MSMQ service process. According to Microsoft, exploitation requires winning a race condition, which raises attack complexity but does not require authentication or user interaction. The EPSS score is 2.241% (84th percentile), indicating measurable exploitation likelihood relative to the broader CVE population.

Root Cause

The issue is a use-after-free ([CWE-416]) triggered by a concurrency flaw ([CWE-362]). When MSMQ processes incoming messages across multiple threads, an object can be freed by one execution path while another path still holds a reference to it. Subsequent dereference of the dangling pointer corrupts memory and can be steered toward attacker-controlled data, enabling arbitrary code execution in the MSMQ service context.

Attack Vector

The attack vector is network based. An attacker sends crafted MSMQ protocol packets to TCP port 1801 on a vulnerable host. No credentials or user interaction are required. Hosts that expose MSMQ to the internet or to untrusted network segments are at the highest risk. Microsoft notes that the Message Queuing service must be installed and running for a system to be exposed. Refer to the Microsoft Security Update CVE-2024-49122 advisory for protocol-level details.

// No verified public proof-of-concept code is available for CVE-2024-49122.
// Exploitation requires crafted MSMQ binary protocol traffic on TCP port 1801
// that triggers the use-after-free race in mqsvc.exe.

Detection Methods for CVE-2024-49122

Indicators of Compromise

Unexpected inbound connections to TCP port 1801, UDP 1801, TCP 2101, 2103, and 2105 on hosts running MSMQ
Crashes or unexpected restarts of the mqsvc.exe process recorded in the Application or System event logs
Child processes spawned by mqsvc.exe such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections originating from mqsvc.exe to unfamiliar external IP addresses

Detection Strategies

Inventory Windows hosts where the Message Queuing feature is installed and validate patch level against the December 2024 update
Hunt for anomalous process lineage where mqsvc.exe is the parent of interactive shells, scripting engines, or LOLBins
Inspect crash dumps and Windows Error Reporting telemetry for mqsvc.exe access violations consistent with use-after-free
Alert on first-seen external sources connecting to MSMQ ports, particularly from untrusted network zones

Monitoring Recommendations

Forward Sysmon process creation, image load, and network connection events for mqsvc.exe to a central log platform
Monitor firewall and NetFlow telemetry for traffic to TCP 1801 from the internet or unmanaged segments
Track Windows feature installation events for MSMQ-Server to maintain an accurate exposure inventory

How to Mitigate CVE-2024-49122

Immediate Actions Required

Apply the December 2024 Microsoft security update for every affected Windows client and server build
Identify all systems with the Message Queuing role enabled and prioritize internet-exposed hosts for patching first
Block inbound TCP 1801, UDP 1801, TCP 2101, 2103, and 2105 at perimeter and internal segmentation firewalls where MSMQ is not required
Disable the Message Queuing feature on systems that do not require it

Patch Information

Microsoft published fixed builds for all supported Windows versions on December 12, 2024. Administrators should consult the Microsoft Security Update CVE-2024-49122 advisory for the specific KB article and build number that applies to each affected operating system, then deploy through Windows Update, WSUS, Microsoft Intune, or Microsoft Configuration Manager.

Workarounds

Remove the Message Queuing Windows feature where it is not in active use, which eliminates the vulnerable service entirely
Restrict MSMQ traffic to authenticated peers using Windows Defender Firewall rules and IPsec authentication
Place MSMQ-dependent servers in segmented VLANs that block external access to MSMQ ports

bash

# Check whether the Message Queuing feature is installed (PowerShell)
Get-WindowsFeature -Name MSMQ*

# Remove the MSMQ server feature if not required
Uninstall-WindowsFeature -Name MSMQ-Server -Restart

# Block inbound MSMQ traffic at the host firewall
New-NetFirewallRule -DisplayName "Block MSMQ TCP 1801" -Direction Inbound `
  -Protocol TCP -LocalPort 1801 -Action Block
New-NetFirewallRule -DisplayName "Block MSMQ UDP 1801" -Direction Inbound `
  -Protocol UDP -LocalPort 1801 -Action Block