CVE-2026-72932: Windows Message Queuing Information Disclosure

CVE-2026-72932 Overview

CVE-2026-72932 is a buffer over-read vulnerability in the Windows Message Queuing (MSMQ) Queue Manager. An unauthenticated attacker can read memory beyond an intended buffer boundary by sending crafted network traffic to an exposed MSMQ service. Successful exploitation discloses process memory contents over the network without requiring credentials or user interaction. The weakness is tracked under CWE-126: Buffer Over-read. Microsoft published details in the Microsoft Security Vulnerability CVE-2026-72932 advisory.

Critical Impact
Remote, unauthenticated attackers can leak sensitive memory contents from the MSMQ Queue Manager process across the network.

Affected Products

Windows operating systems with the Message Queuing (MSMQ) role or feature enabled
Windows Server deployments running the MSMQ Queue Manager service
Windows client systems with the optional MSMQ component installed

Discovery Timeline

2026-09-08 - CVE-2026-72932 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72932

Vulnerability Analysis

The vulnerability resides in how the Windows Message Queuing Queue Manager processes inbound protocol messages. The service reads data past the end of a buffer while parsing attacker-controlled input. The out-of-bounds read exposes adjacent process memory, which can be returned to the caller in response fields or error paths.

The issue affects confidentiality only. It does not directly enable code execution or modification of data on the target. Leaked memory can contain queue contents, authentication material, pointers useful for bypassing address space layout randomization (ASLR), or other sensitive state held by the Queue Manager process.

EPSS data assigns a 1.049% probability of exploitation within the next 30 days as of 2026-09-10, placing the CVE in the 62nd percentile.

Root Cause

The defect is a classic buffer over-read [CWE-126]. The Queue Manager trusts a length or offset field from a network message without validating it against the actual size of the receive buffer. When the parser subsequently copies or serializes data using that untrusted length, it walks past the allocation boundary and reads memory that belongs to unrelated structures.

Attack Vector

Exploitation is fully remote. An attacker sends a malformed MSMQ protocol message to TCP port 1801 or another exposed MSMQ endpoint. No authentication, elevated privileges, or user interaction is required. Systems that expose MSMQ to untrusted networks, including internet-facing hosts and flat internal segments, are directly reachable.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at publication time. Microsoft has not listed the CVE on the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft Security Response Center advisory for protocol-level details.

Detection Methods for CVE-2026-72932

Indicators of Compromise

Unexpected inbound TCP connections to port 1801 from untrusted or external sources
Anomalous or malformed MSMQ protocol messages producing repeated mqsvc.exe errors in the Windows Application event log
Crashes, restarts, or memory-usage spikes in the mqsvc.exe process

Detection Strategies

Inspect network telemetry for MSMQ traffic (TCP 1801, 2101, 2103, 2105, and UDP 3527) originating from systems that do not normally speak the protocol
Alert on any host with the MSMQ service listening that also has an inbound path from the internet or a low-trust zone
Correlate mqsvc.exe faults with preceding external MSMQ sessions to identify probing attempts

Monitoring Recommendations

Enable Windows Firewall logging on hosts running the Queue Manager and forward events to a centralized log store
Monitor process integrity and memory anomalies for mqsvc.exe using endpoint telemetry
Track service configuration changes that enable the MSMQ feature on systems where it is not required

How to Mitigate CVE-2026-72932

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72932 to all Windows systems with MSMQ installed
Inventory hosts where the Message Queuing feature is enabled and remove it where it is not in active use
Block TCP 1801 and related MSMQ ports at the perimeter and between network segments that do not require the service

Patch Information

Microsoft addressed the buffer over-read in the Message Queuing Queue Manager as part of the update cycle documented in the MSRC advisory. Administrators should install the update for their specific Windows version through Windows Update, WSUS, or the Microsoft Update Catalog. Confirm remediation by validating the patched binary versions of mqqm.dll and related MSMQ components after installation.

Workarounds

Disable the Message Queuing Windows feature on systems that do not require it using Server Manager or Disable-WindowsOptionalFeature
Restrict inbound access to MSMQ ports using host-based firewall rules that permit only known application peers
Place MSMQ endpoints behind IPsec or a VPN to prevent unauthenticated network reachability

bash

# Configuration example: disable MSMQ and block port 1801 on Windows
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block