{"id":"CVE-2026-118125","kind":"vulnerability","aliases":["CVE-2026-118125"],"related":[],"title":"Windows Message Queuing: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.","summary":"Race-condition use-after-free (CWE-416/362) in Windows Message Queuing lets a local user with a low-privilege account elevate privileges. Microsoft rates it CVSS 7.0 (local, high complexity, low privileges). Microsoft's CNA data lists the fixed builds below.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","msmq","privilege-escalation","windows"],"not_affected_if":["msmq-not-installed"],"how_to_check":"1) Is MSMQ installed? PowerShell: Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Container (State Enabled), or Get-Service MSMQ. If not installed, you are likely not exposed (MSRC page not read to confirm). 2) Check build: winver or [System.Environment]::OSVersion.Version, compare with the fixed builds in the fix field.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. Exact KB numbers: see the MSRC entry (not read).","status":"open","published_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:52:06+00:00","updated_at":"2026-11-10T23:25:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:52:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Message Queuing: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Message Queuing lets an attacker who already has a local account run code with higher privileges. The sources give no further detail on the exact trigger or affected builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","msmq"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft patch from the MSRC entry for CVE-2026-118125; the NVD record alone gives no fix or version data.","how_to_check":"- Check whether the Message Queuing (MSMQ) Windows feature is installed, for example with `Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Container` in PowerShell, or in Windows Features.\n- Compare the installed Windows build against Microsoft's security update guide entry for CVE-2026-118125.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["msmq-not-installed"],"who_is_affected":"Machines running Windows with the Message Queuing component are the ones to look at, since the flaw sits in that service. The sources do not list affected Windows versions, and systems without Message Queuing installed are likely not exposed. Exploitation requires an authorized local attacker, so the risk is greatest on shared servers and multi-user hosts.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4480,"output_tokens":584,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft patch from the MSRC entry for CVE-2026-118125; the NVD record alone gives no fix or version data.","search":"'-118125':17A,20A '-2026':16A,19A '-416':72B '/362':73B '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A '7.0':94B 'account':87B 'allow':115C 'attack':118C 'author':117C 'build':107B 'cna':102B 'complex':97B 'condit':66B 'cve':15A,18A 'cvss':93B 'cwe':71B 'data':103B 'elev':88B,120C 'escal':62B 'fix':106B 'free':7A,70B,110C 'gain':12A 'high':96B 'higher':13A 'infrastructur':58B 'let':8A,78B 'list':104B 'local':10A,80B,95B,122C 'low':85B,98B 'low-privileg':84B 'messag':2A,76B,113C 'microsoft':90B,100B 'msmq':59B 'privileg':14A,61B,86B,89B,99B,121C 'privilege-escal':60B 'queu':3A,77B,114C 'race':65B 'race-condit':64B 'rate':91B 'server':24A,29A,53A,56A 'use':5A,68B,108C 'use-after-fre':4A,67B 'user':11A,81B 'window':1A,63B,75B,112C 'windows':21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016-2025 machines with the Message Queuing (MSMQ) feature enabled and builds older than the fixed ones listed. The attacker needs a local low-privilege account, so the main risk is shared servers, terminal servers and machines where an attacker already has a foothold. Machines without MSMQ installed can likely skip it (MSRC page not read to confirm).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","msmq","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-118125':17A,20A '-2026':16A,19A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'messag':2A 'privileg':14A 'queu':3A 'server':24A,29A,53A,56A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","search_b":"'-416':72B '/362':73B '7.0':94B 'account':87B 'build':107B 'cna':102B 'complex':97B 'condit':66B 'cvss':93B 'cwe':71B 'data':103B 'elev':88B 'escal':62B 'fix':106B 'free':70B 'high':96B 'infrastructur':58B 'let':78B 'list':104B 'local':80B,95B 'low':85B,98B 'low-privileg':84B 'messag':76B 'microsoft':90B,100B 'msmq':59B 'privileg':61B,86B,89B,99B 'privilege-escal':60B 'queu':77B 'race':65B 'race-condit':64B 'rate':91B 'use':68B 'use-after-fre':67B 'user':81B 'window':63B,75B","search_c":"'allow':115C 'attack':118C 'author':117C 'elev':120C 'free':110C 'local':122C 'messag':113C 'privileg':121C 'queu':114C 'use':108C 'window':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118125","severity":null,"published_at":"2026-11-10T19:19:31+00:00","modified_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118125:3167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118125","severity":null,"published_at":"2026-11-10T23:25:48+00:00","modified_at":"2026-11-10T23:25:48+00:00","first_seen_at":"2026-11-10T23:25:48+00:00","fetched_at":"2026-11-10T23:25:48+00:00","note":"MSRC page not readable via web-cli; builds taken from Microsoft CNA data mirrored on NVD (not vendor page), so nothing marked verified. No exploitation or PoC info found; no social search done (local, high-complexity bug).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-118125"]}],"documents":[{"id":120155,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118125","title":"NVD CVE-2026-118125 (CNA data from Microsoft)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}