Advisory · CVE-2026-100202
Use-after-free in Windows Message Queuing allows unauthenticated network code execution
Microsoft Message Queuing (MSMQ) has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
- Vendor
- Microsoft
- Product
- Windows Message Queuing
- Identifier / CWE
- CVE-2026-100202
CWE-416 - Action timing
- Immediate
Explain it like I’m five
The queue manager keeps using a piece of memory after letting it go, and an attacker who times a network message right can move into that gap.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Windows Message Queuing.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-100202 in its October 2026 update guide: a use-after-free weakness (CWE-416) in the Windows Message Queuing Queue Manager lets an unauthorized attacker execute code over a network, with no privileges or user interaction.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Message Queuing deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Message Queuing while remediation is underway, especially for internet-facing instances.
- Review application and server logs for MSMQ service crashes, unusual queue traffic from unfamiliar hosts, and new processes spawned under the queue service.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
MSMQ is often enabled quietly for legacy applications and then forgotten. A 9.8 network code execution flaw there deserves same-cycle patching and an inventory of where the service is even on.