{"id":"CVE-2026-119964","kind":"vulnerability","aliases":["CVE-2026-119964"],"related":[],"title":"Windows Message Queuing: double free lets an attacker run code remotely","description":"Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.","summary":"A double free bug in Windows Message Queuing lets an unauthorized attacker send crafted network traffic that runs code. The sources say nothing more about the trigger or the affected Windows versions.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Message Queuing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","message-queuing","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:34:40+00:00","updated_at":"2026-11-10T19:34:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Message Queuing: double free lets an attacker run code remotely","impact":"high","summary":"A double free bug in Windows Message Queuing lets an unauthorized attacker send crafted network traffic that runs code. The sources say nothing more about the trigger or the affected Windows versions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","message-queuing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-119964 to confirm affected Windows versions, the patch, and whether MSMQ is enabled by default.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Message Queuing","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":4478,"output_tokens":391,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-119964 to confirm affected Windows versions, the patch, and whether MSMQ is enabled by default.","search":"'-119964':14A,17A '-2026':13A,16A 'affect':55B 'allow':64C 'attack':8A,37B,67C 'bug':29B 'code':10A,44B,70C 'craft':39B 'cve':12A,15A 'doubl':4A,27B,58C 'execut':69C 'free':5A,28B,59C 'infrastructur':21B 'let':6A,34B 'messag':2A,23B,32B,62C 'message':19A 'message-queu':22B 'network':40B,73C 'noth':48B 'queu':3A,24B,33B,63C 'queuing':20A 'remot':11A 'run':9A,43B 'say':47B 'send':38B 'sourc':46B 'traffic':41B 'trigger':52B 'unauthor':36B,66C 'version':57B 'window':1A,25B,31B,56B,61C 'windows':18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["messagequeuing","windowsmessagequeuing"],"ptokens":["message","queuing","windows"],"labels":["high","infrastructure","messagequeuing","vendor","windows"],"campaign_type":null,"search_a":"'-119964':14A,17A '-2026':13A,16A 'attack':8A 'code':10A 'cve':12A,15A 'doubl':4A 'free':5A 'let':6A 'messag':2A 'message':19A 'queu':3A 'queuing':20A 'remot':11A 'run':9A 'window':1A 'windows':18A","search_b":"'affect':55B 'attack':37B 'bug':29B 'code':44B 'craft':39B 'doubl':27B 'free':28B 'infrastructur':21B 'let':34B 'messag':23B,32B 'message-queu':22B 'network':40B 'noth':48B 'queu':24B,33B 'run':43B 'say':47B 'send':38B 'sourc':46B 'traffic':41B 'trigger':52B 'unauthor':36B 'version':57B 'window':25B,31B,56B","search_c":"'allow':64C 'attack':67C 'code':70C 'doubl':58C 'execut':69C 'free':59C 'messag':62C 'network':73C 'queu':63C 'unauthor':66C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119964","severity":null,"published_at":"2026-11-10T19:20:21+00:00","modified_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}