CVE-2025-53143: Windows 10 1507 RCE Vulnerability

CVE-2025-53143 Overview

CVE-2025-53143 is a type confusion vulnerability in Microsoft Windows Message Queuing (MSMQ) that allows an authorized attacker to execute code remotely over a network. The flaw is tracked under CWE-843 and affects a broad range of Windows client and server editions, from Windows 10 1507 through Windows Server 2025. Microsoft published the advisory on August 12, 2025, and exploitation requires the attacker to hold low-privilege credentials on the target network. The Exploit Prediction Scoring System (EPSS) places the probability of exploitation at 7.911%, in the 92.13 percentile of all CVEs.

Critical Impact
An authenticated attacker can trigger type confusion in the MSMQ service to execute arbitrary code over the network, leading to full compromise of confidentiality, integrity, and availability on affected Windows hosts.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-08-12 - CVE-2025-53143 published to NVD and Microsoft releases security update
2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-53143

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing service, which provides asynchronous messaging between distributed applications over TCP port 1801 and related RPC endpoints. The service mishandles object type interpretation when processing serialized message structures received from a remote client. An attacker who can authenticate to the MSMQ service can craft a message that the parser treats as a different object type than was actually supplied. This type confusion corrupts internal state and allows the attacker to redirect execution flow inside the privileged MSMQ process context. Successful exploitation results in arbitrary code execution with the privileges of the MSMQ service, typically NETWORK SERVICE or SYSTEM, depending on configuration.

Root Cause

The defect is classified as [CWE-843] — Access of Resource Using Incompatible Type. The MSMQ message dispatcher fails to validate that a deserialized field matches the type expected by downstream handlers. When a mismatched type is processed, pointer fields and function tables are dereferenced as the wrong structure, enabling memory corruption that can be steered toward code execution.

Attack Vector

Exploitation occurs over the network and requires low privileges with no user interaction. The attacker sends a malicious MSMQ message to a host where the MSMQ service is enabled and reachable. Because MSMQ is frequently exposed within enterprise networks for application messaging, lateral movement scenarios are realistic where an attacker who compromises a single domain account can pivot to MSMQ-enabled servers.

No public proof-of-concept code has been released. Microsoft has not flagged the issue as exploited in the wild, and it is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing. See the Microsoft Security Update CVE-2025-53143 advisory for technical detail.

Detection Methods for CVE-2025-53143

Indicators of Compromise

Unexpected child processes spawned by mqsvc.exe, particularly cmd.exe, powershell.exe, or other LOLBins.
Crashes or repeated restarts of the MSMQ service logged under Windows Event ID 7031 or 7034.
Anomalous inbound connections on TCP port 1801 or MSMQ RPC ports from non-application hosts.
New or modified message queue files under %SystemRoot%\System32\msmq\storage\.

Detection Strategies

Hunt for mqsvc.exe parent-child relationships that deviate from baseline messaging application behavior.
Inspect Windows Defender Firewall and network telemetry for unauthorized connections to MSMQ ports from workstation subnets.
Correlate authentication events with MSMQ access from accounts that do not normally use the service.
Deploy endpoint behavioral detection that flags memory corruption patterns and unusual thread injection inside mqsvc.exe.

Monitoring Recommendations

Enable verbose MSMQ logging and forward Microsoft-Windows-MSMQ event channels to a centralized SIEM.
Monitor service binary integrity for mqsvc.exe and supporting DLLs in %SystemRoot%\System32\.
Alert on first-time process creation under mqsvc.exe across the fleet using behavioral baselines.

How to Mitigate CVE-2025-53143

Immediate Actions Required

Apply the August 2025 Microsoft security update referenced in the Microsoft Security Update CVE-2025-53143 advisory to every affected Windows client and server.
Inventory hosts where the Message Queuing Windows feature is installed and prioritize patching exposed servers first.
Restrict inbound access to TCP port 1801 and MSMQ RPC endpoints using host and perimeter firewalls.
Audit which accounts hold MSMQ permissions and revoke any unused or excessive grants.

Patch Information

Microsoft released the security fix for CVE-2025-53143 on August 12, 2025. The update is distributed through the standard cumulative update channels for each supported Windows version. Administrators should consult the Microsoft Security Update CVE-2025-53143 advisory for the specific KB article applicable to their build.

Workarounds

Disable the Message Queuing (MSMQ) Windows feature on hosts that do not require it using Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Container.
Block TCP port 1801 inbound at the perimeter and segment MSMQ-dependent application servers from general user networks.
Enforce least-privilege MSMQ queue access control lists so that only required service accounts can send messages.

bash

# Check whether the MSMQ service is installed and running
Get-Service -Name MSMQ -ErrorAction SilentlyContinue

# Block inbound traffic to the default MSMQ TCP port
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block

# Disable the MSMQ feature where not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Container -NoRestart