---
id: "CVE-2026-109459"
page: "https://infrastack.ai/live/CVE-2026-109459"
kind: "vulnerability"
aliases: ["CVE-2026-109459"]
title: "Windows Message Queuing: heap overflow lets an unauthorized attacker run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "msmq", "windows"]
not_affected_if: ["msmq-not-installed"]
published_at: "2026-11-10T19:18:14+00:00"
first_seen_at: "2026-11-10T19:24:24+00:00"
updated_at: "2026-11-10T19:35:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109459", "first_seen_at": "2026-11-10T19:24:24+00:00"}]
exploit_sources: []
---

# Windows Message Queuing: heap overflow lets an unauthorized attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-109459 (this .md is for agents)

A heap-based buffer overflow in the Windows Message Queuing Queue Manager lets an attacker write past allocated memory. The flaw can be triggered over the network and allows code execution without authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Message Queuing (MSMQ) Windows feature is installed and running on the host

## Timeline

- 2026-11-10T19:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109459

## From the sources

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_