CVE-2025-53144: Windows 10 1507 MSMQ RCE Vulnerability

CVE-2025-53144 Overview

CVE-2025-53144 is a type confusion vulnerability [CWE-843] in the Microsoft Message Queuing (MSMQ) service. An authenticated attacker can send crafted MSMQ traffic over the network to trigger access of a resource using an incompatible type, leading to remote code execution on the target host. The flaw affects supported Windows client and server releases that have the Message Queuing role or feature enabled.

The vulnerability carries a CVSS 3.1 base score of 8.8 and an EPSS probability of 11.866%, placing it in the 93.854 percentile for likelihood of exploitation. No public proof-of-concept has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation grants attackers code execution in the context of the MSMQ service, enabling lateral movement and full host compromise across patched and unpatched Windows infrastructure.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Any Windows host with the Message Queuing (MSMQ) role or feature enabled

Discovery Timeline

2025-08-12 - CVE-2025-53144 published to NVD
2025-08-18 - Last updated in NVD database

Technical Details for CVE-2025-53144

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing service, which listens on TCP port 1801 by default and processes serialized messages from local and remote clients. The service interprets incoming message fields against expected internal object types. A crafted message can cause the service to access a memory region using an incompatible type, which corrupts internal state and produces a controllable code path.

Because MSMQ runs as mqsvc.exe under the NT AUTHORITY\NETWORK SERVICE account, attacker-controlled code executes with the privileges of that service. The attacker requires low-privilege authentication to the target, but no user interaction is needed. Exploitation impacts confidentiality, integrity, and availability.

Root Cause

The root cause is improper type checking when MSMQ deserializes or dispatches message structures. The service casts an object to a type that does not match the underlying memory layout, an issue tracked as [CWE-843] Access of Resource Using Incompatible Type. The mismatched cast allows out-of-bounds field interpretation and hijacking of execution flow.

Attack Vector

An authenticated attacker sends a malformed MSMQ packet to the listening port on a vulnerable host. The packet contains type fields that diverge from the data the service later operates on. When MSMQ processes the message, the type confusion is triggered, the service mishandles the object, and the attacker gains arbitrary code execution. Refer to the Microsoft CVE-2025-53144 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2025-53144

Indicators of Compromise

Unexpected child processes spawned by mqsvc.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or repeated restarts of the Message Queuing service recorded in the System event log.
Inbound TCP connections to port 1801 from untrusted internal or external hosts.
New outbound network connections originating from the MSMQ service process.

Detection Strategies

Inspect process lineage for mqsvc.exe and alert on any non-standard child process creation.
Monitor Windows Filtering Platform and firewall logs for connections to TCP/1801 from systems that do not normally use MSMQ.
Hunt for MSMQ-related crash events (Event IDs 1000, 1001) followed by service restarts within a short window.

Monitoring Recommendations

Enable command-line and process creation auditing (Event ID 4688) on all hosts with the MSMQ role installed.
Forward MSMQ and security logs to a central platform for correlation across hosts.
Baseline expected MSMQ peers and alert on deviations in source IP or message volume.

How to Mitigate CVE-2025-53144

Immediate Actions Required

Apply the August 2025 Microsoft security updates referenced in the Microsoft CVE-2025-53144 Advisory to all affected Windows versions.
Inventory hosts with the Message Queuing role or feature enabled and prioritize patching for any system exposed to untrusted networks.
Restrict inbound access to TCP/1801 to known MSMQ peers using host and network firewalls.

Patch Information

Microsoft published patches for CVE-2025-53144 on 2025-08-12 across all supported Windows client and server releases listed in the advisory. Administrators should deploy the corresponding monthly cumulative or security-only update for each operating system version. Hosts running Windows Server 2008 and 2008 R2 require Extended Security Updates.

Workarounds

Disable the Message Queuing service (mqsvc) on systems that do not require it, then remove the Windows feature to reduce attack surface.
Block TCP port 1801 at the perimeter and on internal segmentation firewalls where MSMQ is not in use.
Limit MSMQ message acceptance to authenticated peers within a defined IPsec or VLAN boundary.

bash

# Disable the Message Queuing service on hosts that do not need it
sc.exe stop MSMQ
sc.exe config MSMQ start= disabled

# Remove the MSMQ feature using PowerShell
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart

# Block inbound TCP/1801 if MSMQ must remain installed
New-NetFirewallRule -DisplayName "Block MSMQ Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block