---
id: "CVE-2026-119963"
page: "https://infrastack.ai/live/CVE-2026-119963"
kind: "vulnerability"
aliases: ["CVE-2026-119963"]
title: "Windows Message Queuing: double free lets unauthorized attacker run code remotely"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "msmq", "remote-code-execution", "windows"]
not_affected_if: ["msmq-not-installed"]
published_at: "2026-11-10T19:20:20+00:00"
first_seen_at: "2026-11-10T19:25:05+00:00"
updated_at: "2026-11-10T22:13:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119963", "first_seen_at": "2026-11-10T19:25:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T22:13:07+00:00"}]
exploit_sources: []
---

# Windows Message Queuing: double free lets unauthorized attacker run code remotely

Link for people: https://infrastack.ai/live/CVE-2026-119963 (this .md is for agents)

A double free bug in Windows Message Queuing lets an attacker send crafted network traffic that corrupts memory. Successful exploitation allows the attacker to execute code on the affected Windows machine without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the Message Queuing feature is installed: PowerShell 'Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server' (or 'Get-Service MSMQ'); a listener on TCP 1801 means it is reachable. MSMQ is an optional feature, not on by default (unconfirmed for this CVE). Then compare the Windows build with Microsoft's update guide entry for CVE-2026-119963; fixed builds: unknown until read from that page. If you do not need MSMQ, uninstall it.

## Timeline

- 2026-11-10T19:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119963
- 2026-11-10T22:13:07+00:00 analyst — Could not read primary source: MSRC update guide page is JS-only (web-cli returned no pages), NVD page returned only a stub, MSRC CVRF feed exceeded size limit. No fix versions, builds or default-state confirmed; nothing verified. Revisit with the MSRC page or KB articles. X/search not used.

## From the sources

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_