CVE-2026-85860: Windows Message Queuing Use After Free

CVE-2026-85860 Overview

CVE-2026-85860 is a use-after-free vulnerability [CWE-416] in the Windows Message Queuing (MSMQ) Queue Manager. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. The vulnerability requires local access and low privileges, with no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability.

Critical Impact
A local, authenticated attacker can trigger freed-memory reuse in the MSMQ Queue Manager to run code at elevated privilege, potentially reaching SYSTEM-level control on the host.

Affected Products

Microsoft Windows (Message Queuing component)
Systems with the MSMQ Queue Manager service enabled
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85860 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85860

Vulnerability Analysis

The flaw resides in the Windows Message Queuing Queue Manager, which handles the lifecycle of queue objects and associated message buffers. A use-after-free condition occurs when the Queue Manager references memory that has already been released. An attacker who controls allocations in the freed region can place crafted data at that address. The dangling pointer dereference then redirects execution flow or corrupts kernel-adjacent state, enabling privilege elevation from a standard user context to a higher-privileged service account.

MSMQ runs as a Windows service with elevated privileges, so successful exploitation typically produces SYSTEM-level code execution. The attack is purely local; the actor must already authenticate to the target host and interact with the MSMQ interface locally.

Root Cause

The root cause is improper object lifetime management inside the Queue Manager [CWE-416]. The component releases a memory object but retains or re-uses a reference to it without validating that the allocation remains valid. Microsoft has not published source-level details, so review the Microsoft Security Update Guide for component-specific context.

Attack Vector

The attack vector is local with low attack complexity and low privilege requirements. An authenticated attacker interacts with the MSMQ Queue Manager through its local interfaces, triggers the freed-object reuse, and sprays controlled data into the freed allocation to influence execution. No user interaction is required.

No public proof-of-concept exploit is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2026-85860

Indicators of Compromise

Unexpected crashes or restarts of the mqsvc.exe Message Queuing service, which may indicate failed exploitation attempts
Creation of new privileged processes or services spawned as children of mqsvc.exe
Unusual local RPC or named-pipe activity targeting MSMQ interfaces from non-administrative users

Detection Strategies

Monitor Windows Error Reporting and application crash dumps for faults originating in the MSMQ Queue Manager
Alert on process-lineage anomalies where mqsvc.exe spawns cmd.exe, powershell.exe, or other interactive binaries
Correlate local privilege-escalation telemetry with MSMQ service activity on the same host within short time windows

Monitoring Recommendations

Enable detailed service-level logging for the Message Queuing service and ship events to a central analytics platform
Track account-token changes and new SYSTEM-level process creation events (Windows Event ID 4688) following MSMQ interactions
Baseline the hosts that legitimately require MSMQ and flag Queue Manager usage on systems outside that baseline

How to Mitigate CVE-2026-85860

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-85860
Inventory all Windows hosts with the Message Queuing feature enabled and prioritize patching of servers exposed to interactive users
Restrict local logon rights on systems running MSMQ to reduce the pool of accounts that could reach the vulnerable interface

Patch Information

Microsoft has issued a fix through the Security Update Guide. Deploy the vendor-supplied cumulative update for the affected Windows build. Validate installation by checking the installed KB against the Microsoft advisory and confirming the Message Queuing service version post-reboot.

Workarounds

Disable the Message Queuing (MSMQ) Windows feature on hosts that do not require it using Server Manager or Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
Stop and disable the MSMQ service where the feature cannot be fully removed, using Stop-Service MSMQ followed by Set-Service MSMQ -StartupType Disabled
Enforce least privilege on multi-user systems and limit the ability of standard users to interact with local service endpoints

bash

# Configuration example: disable MSMQ on hosts that do not need it
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled