CVE-2026-62717: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62717 Overview

CVE-2026-62717 is a heap-based buffer overflow [CWE-122] in the Windows Message Queuing (MSMQ) service. An authorized local attacker can exploit the flaw to corrupt heap memory and elevate privileges on affected Windows client and server systems. Microsoft published the advisory on 2026-08-11 and last updated it on 2026-08-13. The vulnerability affects a broad range of supported Windows versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025. No public exploit or CISA KEV listing is currently associated with this CVE.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the local host, enabling full compromise of confidentiality, integrity, and availability of the affected system.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62717 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62717

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing service, a core component that enables applications to communicate asynchronously via message queues. Improper validation of message data length during heap allocation results in a heap-based buffer overflow [CWE-122]. An attacker with local, low-privileged access can craft input that overflows an MSMQ heap buffer. The overflow corrupts adjacent heap metadata or object pointers, enabling controlled memory writes. Because the MSMQ service typically runs with NT AUTHORITY\NetworkService or SYSTEM-adjacent privileges, successful exploitation yields privilege escalation on the local host. No user interaction is required, and the attack complexity is low.

Root Cause

The root cause is insufficient bounds checking on attacker-controlled length fields when MSMQ processes a locally submitted message. The service allocates a heap buffer using one size while copying data based on a different, unvalidated size, producing an out-of-bounds write on the heap.

Attack Vector

Exploitation requires local access and low-privileged authenticated context. The attacker interacts with the MSMQ service through its local IPC interfaces, submitting a specially crafted message that triggers the overflow. There are no verified public proof-of-concept exploits at the time of writing. See the Microsoft CVE-2026-62717 Update Guide for the vendor's technical description.

Detection Methods for CVE-2026-62717

Indicators of Compromise

Unexpected crashes, restarts, or access violations in the mqsvc.exe (Message Queuing) service process.
Creation of new services, scheduled tasks, or privileged accounts shortly after MSMQ service anomalies.
Local processes writing to or interacting with \\.\pipe\ endpoints associated with MSMQ from unusual user contexts.

Detection Strategies

Monitor Windows Event Log sources Application Error and Service Control Manager for mqsvc.exe faults with heap-related exception codes such as 0xC0000374 or 0xC0000005.
Enable Windows Error Reporting and crash dump collection on hosts running MSMQ to capture exploitation attempts for forensic analysis.
Hunt for low-privileged processes spawning MSMQ client APIs immediately followed by privileged child processes owned by SYSTEM.

Monitoring Recommendations

Inventory all endpoints and servers where the Message Queuing feature is installed and enabled, and treat them as elevated-priority assets.
Alert on outbound lateral movement or credential access activity originating from hosts that recently experienced MSMQ service instability.
Track patch compliance for the August 2026 Microsoft security updates across the affected Windows versions.

How to Mitigate CVE-2026-62717

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62717 Update Guide to all affected Windows client and server systems.
Identify hosts where the Message Queuing feature is not required and disable or uninstall it to reduce the attack surface.
Restrict local logon rights on servers that run MSMQ to only trusted administrative accounts.

Patch Information

Microsoft has released security updates addressing CVE-2026-62717 across all affected Windows 10, Windows 11, and Windows Server versions. Refer to the Microsoft CVE-2026-62717 Update Guide for the specific KB article and package for each supported build. Prioritize patching on multi-user systems, jump hosts, and servers exposed to untrusted local users.

Workarounds

If patching cannot be performed immediately, disable the Message Queuing service by setting the MSMQ service start type to Disabled and stopping the running instance.
Remove the Message Queuing Windows feature on hosts that do not use MSMQ for application messaging.
Enforce least-privilege policies so that non-administrative users cannot execute arbitrary code on servers running MSMQ.

bash

# Configuration example - disable and stop the MSMQ service on Windows
sc.exe config MSMQ start= disabled
sc.exe stop MSMQ

# Optionally remove the Message Queuing Windows feature (PowerShell)
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart