CVE-2026-85334: Windows Message Queuing Information Leak

CVE-2026-85334 Overview

CVE-2026-85334 is an out-of-bounds read vulnerability [CWE-125] in the Windows Message Queuing (MSMQ) Queue Manager. An unauthorized attacker can disclose sensitive information over a network by sending crafted MSMQ traffic to a vulnerable host. The flaw requires no authentication, no user interaction, and is exploitable from the network, making exposed MSMQ endpoints a direct risk. Microsoft published the advisory in its Security Update Guide and tracks remediation through the standard monthly servicing channels.

Critical Impact
Remote, unauthenticated attackers can read process memory from the MSMQ Queue Manager, potentially exposing in-memory data such as message contents, pointers, or other sensitive runtime state.

Affected Products

Windows (Message Queuing / MSMQ Queue Manager component) — refer to the Microsoft Security Update Guidance for the authoritative list of affected builds
Any Windows Server or client role with the Message Queuing feature enabled
Systems exposing TCP port 1801 (MSMQ) to untrusted networks

Discovery Timeline

2026-10-13 - CVE-2026-85334 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85334

Vulnerability Analysis

The vulnerability resides in the Windows Message Queuing Queue Manager, the service responsible for handling MSMQ protocol messages between distributed applications. The Queue Manager parses attacker-controlled network input and reads beyond the bounds of an allocated buffer. This out-of-bounds read returns adjacent process memory contents to the attacker as part of normal protocol processing or error responses.

The disclosure impact is high, but integrity and availability are not affected, consistent with a pure information-disclosure primitive. Leaked memory can include queued message fragments, internal pointers useful for bypassing Address Space Layout Randomization (ASLR), or authentication-related tokens handled by the service. Such primitives are frequently paired with memory corruption bugs to achieve reliable remote code execution.

The EPSS probability sits above the baseline for new Windows network-facing CVEs, reflecting the exposure profile of MSMQ services historically targeted by exploit developers.

Root Cause

The root cause is missing or incorrect bounds validation when the Queue Manager reads a length-prefixed or structured field from an inbound MSMQ message. When the declared size exceeds the actual buffer, the parser reads past the allocation boundary. This is a classic [CWE-125] pattern in binary protocol parsers.

Attack Vector

An attacker sends a specially crafted MSMQ message to a reachable Queue Manager, typically over TCP port 1801. No credentials or user interaction are required. The server processes the malformed structure and returns or logs memory beyond the intended buffer, exposing that content to the sender. Repeated requests can be used to iteratively harvest memory regions.

No verified public proof-of-concept code is available at the time of publication. See the Microsoft Security Update Guidance for authoritative technical details.

Detection Methods for CVE-2026-85334

Indicators of Compromise

Inbound TCP connections to port 1801 from untrusted or external source addresses
Malformed MSMQ protocol frames with length fields that do not match payload size
Repeated short-lived MSMQ sessions from the same source performing probing patterns
Unexpected crashes, access violations, or Windows Error Reporting events tied to mqsvc.exe

Detection Strategies

Enable network inspection for MSMQ traffic and alert on protocol anomalies, including oversized or truncated length fields
Monitor the Message Queuing service (mqsvc.exe) for abnormal memory access patterns, exceptions, or restarts
Correlate inbound port 1801 traffic with external threat intelligence covering MSMQ-targeting activity
Hunt for high-volume, low-byte MSMQ sessions characteristic of memory-harvesting loops

Monitoring Recommendations

Inventory all hosts with the Message Queuing feature installed, including dormant installations enabled by third-party software
Baseline legitimate MSMQ peers and alert on new or external initiators
Capture Windows Event Log entries from the MSMQ provider and forward them to central logging
Track patch deployment status for the October 2026 Microsoft security update cycle

How to Mitigate CVE-2026-85334

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guidance on all affected systems
Identify hosts with MSMQ installed by checking for the Message Queuing Windows feature or the running MSMQ service
Block inbound TCP port 1801 at perimeter firewalls and restrict it to known internal peers via host firewall rules
Prioritize patching for internet-exposed or DMZ systems where MSMQ is reachable

Patch Information

Microsoft addressed CVE-2026-85334 in its October 2026 security update cycle. Administrators should consult the Microsoft Security Update Guidance for the specific KB article and build numbers that correspond to each supported Windows version. Deploy updates through Windows Update, WSUS, Microsoft Update Catalog, or Intune/Configuration Manager according to standard change-control processes.

Workarounds

Disable the Message Queuing Windows feature on systems that do not require it
Stop and disable the MSMQ service where the feature cannot be removed immediately
Restrict TCP port 1801 (and related MSMQ ports 2101, 2103, 2105) to trusted internal subnets using Windows Defender Firewall or network ACLs
Place MSMQ-dependent applications behind an authenticated gateway or VPN to remove unauthenticated network reachability

bash

# Example: disable the MSMQ Windows feature and block MSMQ ports via PowerShell
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled

New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" `
  -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block