CVE-2026-33838 Overview
CVE-2026-33838 is a double free vulnerability in the Windows Message Queuing (MSMQ) service. The flaw allows an authorized local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on May 12, 2026, covering supported releases of Windows 10, Windows 11, and Windows Server. The vulnerability is tracked under CWE-415 and requires low privileges, low attack complexity, and no user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability of the targeted host.
Critical Impact
A local attacker with low-privileged access can trigger a double free in the MSMQ service to elevate privileges to SYSTEM, gaining full control of the affected Windows host.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2026-05-12 - CVE-2026-33838 published to NVD
- 2026-05-12 - Microsoft releases security advisory
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-33838
Vulnerability Analysis
The vulnerability resides in the Windows Message Queuing service, a component that handles asynchronous messaging between applications. The defect is classified as a double free condition [CWE-415], in which the same memory region is released to the heap allocator twice during message processing. The second free operation corrupts allocator metadata, enabling controlled reuse of freed chunks.
An attacker who already holds authenticated local access can craft message queue operations that drive the service into the vulnerable code path. The attack vector is local, and exploitation does not require user interaction. Because MSMQ runs with elevated privileges, successful memory corruption translates directly into privilege elevation on the host.
Root Cause
The root cause is improper lifetime tracking of a heap-allocated object inside the MSMQ service. When two distinct code paths both assume ownership of the buffer, the second deallocation operates on memory that has already been returned to the allocator. Heap allocator metadata becomes inconsistent, creating conditions suitable for arbitrary write primitives.
Attack Vector
Exploitation requires local authenticated access to a system where the Message Queuing service is enabled. The attacker submits crafted operations to the MSMQ service to trigger the duplicate deallocation. After corrupting allocator state, the attacker steers subsequent allocations to overlap attacker-controlled data with sensitive structures, ultimately executing code in the SYSTEM context. The full technical mechanism is documented in the Microsoft Vulnerability Advisory.
Detection Methods for CVE-2026-33838
Indicators of Compromise
- Unexpected crashes, restarts, or access violations in the mqsvc.exe process recorded in the Windows Application or System event logs.
- Creation of new privileged processes whose parent is mqsvc.exe or related MSMQ binaries.
- Anomalous local connections to TCP port 1801, the default MSMQ listener, from non-administrative user sessions.
Detection Strategies
- Monitor Windows Error Reporting (WER) and crash dumps for heap corruption signatures originating in MSMQ libraries such as mqqm.dll or mqac.sys.
- Alert on token elevation events (Event ID 4672) tied to processes spawned by the MSMQ service after suspicious queue activity.
- Enable PageHeap or Application Verifier on mqsvc.exe in lab environments to surface double free conditions during testing and validation.
Monitoring Recommendations
- Inventory systems where the Message Queuing feature is installed and enabled, and treat them as priority assets for patching.
- Track local privilege escalation telemetry, including unexpected SYSTEM token issuance following user-context activity.
- Correlate process creation, service crashes, and authentication events to identify chained exploitation attempts targeting MSMQ.
How to Mitigate CVE-2026-33838
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft Vulnerability Advisory for every affected Windows 10, Windows 11, and Windows Server build.
- Audit endpoints and servers for the presence of the Message Queuing feature, and disable it on systems that do not require MSMQ.
- Restrict local logon rights to reduce the population of accounts that can reach the vulnerable code path.
Patch Information
Microsoft has released cumulative security updates for all supported Windows versions listed in the advisory. Administrators should consult the Microsoft Vulnerability Advisory for the specific KB numbers that map to each operating system build and deploy them through Windows Update, WSUS, or their preferred patch management platform.
Workarounds
- Disable the Message Queuing (MSMQ) Windows feature where it is not in use to remove the vulnerable service from the attack surface.
- Block inbound TCP port 1801 at the host firewall on systems that retain MSMQ but do not require remote queue access.
- Apply the principle of least privilege so that interactive logons on MSMQ servers are limited to administrators and required service accounts.
# Disable the Message Queuing feature on Windows (PowerShell, run as Administrator)
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
# Stop and disable the MSMQ service if the feature must remain installed
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled
# Block inbound MSMQ traffic at the host firewall
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
