CVE-2026-65790: Windows Message Queuing Privilege Escalation

CVE-2026-65790 Overview

CVE-2026-65790 is a heap-based buffer overflow [CWE-122] in the Windows Message Queuing (MSMQ) service. An authenticated local attacker can corrupt heap memory to elevate privileges on an affected Windows host. Microsoft published the advisory on 2026-08-11 and assigned a CVSS 3.1 base score of 7.8.

The flaw requires low privileges and no user interaction. Successful exploitation grants full impact to confidentiality, integrity, and availability on the compromised system. See the Microsoft Security Update for CVE-2026-65790 for vendor details.

Critical Impact
Local privilege escalation to SYSTEM through heap corruption in the MSMQ service on hosts where Message Queuing is enabled.

Affected Products

Microsoft Windows (versions with the Message Queuing feature enabled)
Windows Server deployments running the MSMQ role
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-08-11 - CVE-2026-65790 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65790

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing service, which processes MSMQ protocol messages received through local IPC and, when enabled, network channels. A heap-based buffer overflow occurs when the service handles a crafted message that exceeds the bounds of a heap-allocated buffer. The overflow overwrites adjacent heap metadata or object pointers within the MSMQ service process.

The MSMQ service typically runs with NT AUTHORITY\NetworkService or elevated privileges, so controlled heap corruption inside its process address space provides a path to code execution at higher privilege than the attacker's own session. The vulnerability requires the attacker to already have a foothold on the host as a low-privileged user.

Root Cause

The root cause is improper validation of size or length fields when copying attacker-controlled data into a fixed-size heap buffer, categorized as [CWE-122] heap-based buffer overflow. Insufficient bounds checking allows the copy to write past the allocated region and clobber adjacent heap structures.

Attack Vector

The attack vector is local. An authenticated attacker sends a malformed message to the local MSMQ endpoint, triggering the overflow inside the service process. Because the attacker controls the payload contents, the corruption can be shaped to hijack execution flow within the elevated MSMQ process and yield SYSTEM-level access.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-65790

Indicators of Compromise

Unexpected crashes or restarts of the MSMQ service (mqsvc.exe), often visible as Windows Error Reporting events referencing the Message Queuing process
New child processes spawned by mqsvc.exe that do not match normal service behavior, particularly command interpreters such as cmd.exe or powershell.exe
Local process creation of privileged accounts, scheduled tasks, or services following interaction with the MSMQ endpoint

Detection Strategies

Monitor process ancestry for any child process of mqsvc.exe; benign MSMQ operation rarely spawns interactive binaries
Alert on repeated crashes of the Message Queuing service in the System event log (Event IDs from source Application Error referencing mqsvc.exe)
Correlate local IPC or TCP/1801 activity to mqsvc.exe from non-service accounts against subsequent privilege changes on the host

Monitoring Recommendations

Enable Windows Defender Application Control or process creation auditing (Event ID 4688) to record child processes of MSMQ
Ingest Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create) filtered on mqsvc.exe into a central SIEM
Track installation state of the Message Queuing Windows feature across the fleet to identify unnecessary exposure

How to Mitigate CVE-2026-65790

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-65790 to all Windows hosts with MSMQ installed
Inventory systems where the Message Queuing feature is enabled and prioritize patching for internet-facing and multi-user hosts
Restrict local access on affected hosts to trusted administrative users until patching completes

Patch Information

Microsoft has released a security update addressing CVE-2026-65790. Consult the Microsoft Security Update Guide entry for the specific KB articles and cumulative updates that correspond to each supported Windows version.

Workarounds

Disable the Windows Message Queuing feature on hosts that do not require it using Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
Stop and disable the MSMQ service where the feature cannot be uninstalled: sc.exe config MSMQ start= disabled followed by sc.exe stop MSMQ
Block inbound TCP/1801, UDP/3527, and TCP/2101-2103 at the host firewall on systems that use MSMQ only for local processing

bash

# Configuration example: disable MSMQ where not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
sc.exe config MSMQ start= disabled
sc.exe stop MSMQ