---
id: "CVE-2026-119964"
page: "https://infrastack.ai/live/CVE-2026-119964"
kind: "vulnerability"
aliases: ["CVE-2026-119964"]
title: "Windows Message Queuing: double free lets an attacker run code remotely"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 / Server 2016", "fixed": ["10.0.14393.9688", "10.0.17763.9487", "10.0.19044.7846", "10.0.19045.7846"], "affected": "< 10.0.14393.9688 (1607/Server 2016); < 10.0.17763.9487 (1809/Server 2019); < 10.0.19044.7846 (21H2); < 10.0.19045.7846 (22H2)", "ecosystem": "vendor"}, {"name": "Windows 11", "fixed": ["10.0.22631.7711", "10.0.26100.9974", "10.0.26200.9974", "10.0.28000.3501", "10.0.26300.9974"], "affected": "< 10.0.22631.7711 (23H2); < 10.0.26100.9974 (24H2); < 10.0.26200.9974 (25H2); < 10.0.28000.3501 (26H1); < 10.0.26300.9974 (26H2)", "ecosystem": "vendor"}, {"name": "Windows Server 2022/2025", "fixed": ["10.0.20348.5870", "10.0.26100.33822"], "affected": "< 10.0.20348.5870 (2022); < 10.0.26100.33822 (2025)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "message-queuing", "msmq", "network", "remote-code-execution", "title-review", "windows"]
not_affected_if: ["msmq-not-installed", "patched"]
published_at: "2026-11-10T19:20:21+00:00"
first_seen_at: "2026-11-10T19:25:05+00:00"
updated_at: "2026-11-10T22:13:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119964", "first_seen_at": "2026-11-10T19:25:05+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-119964", "first_seen_at": "2026-11-10T22:13:42+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-119964", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119964"]}]
exploit_sources: []
---

# Windows Message Queuing: double free lets an attacker run code remotely

Link for people: https://infrastack.ai/live/CVE-2026-119964 (this .md is for agents)

Microsoft's CVE record: a double free in Windows Message Queuing lets an unauthenticated attacker run code over the network. CVSS 8.1 (attack complexity high). Not known to be exploited and no public PoC as of publication on 2026-11-10 (CISA SSVC: exploitation none). Fixed in the November 2026 updates.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10 / Server 2016 affected < 10.0.14393.9688 (1607/Server 2016); < 10.0.17763.9487 (1809/Server 2019); < 10.0.19044.7846 (21H2); < 10.0.19045.7846 (22H2) fixed 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846
- vendor:Windows 11 affected < 10.0.22631.7711 (23H2); < 10.0.26100.9974 (24H2); < 10.0.26200.9974 (25H2); < 10.0.28000.3501 (26H1); < 10.0.26300.9974 (26H2) fixed 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974
- vendor:Windows Server 2022/2025 affected < 10.0.20348.5870 (2022); < 10.0.26100.33822 (2025) fixed 10.0.20348.5870, 10.0.26100.33822

## How to check

On each Windows host, run in PowerShell: Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server (State Enabled means MSMQ is installed) and Get-Service MSMQ. If present, compare the OS build (cmd: ver) with the fixed build for your release. Also check whether TCP 1801 is reachable, the usual MSMQ port; that port comes from a SANS write-up on a sibling CVE, not from this advisory.

## Fix

Install the November 2026 Windows cumulative update: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.

## Timeline

- 2026-11-10T19:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119964
- 2026-11-10T22:13:42+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-119964 — MSRC page is JS-only and unreadable; versions taken from Microsoft's own CNA CVE record (cveawg), which points to MSRC. MSMQ default-enabled state and workarounds not confirmed; no exploitation or PoC seen (CISA SSVC none). Web only, no X check.

## Documents

- [advisory] CVE-2026-119964 CVE record (Microsoft CNA) https://cveawg.mitre.org/api/cve/CVE-2026-119964
- [fix] MSRC Security Update Guide: CVE-2026-119964 (page is JavaScript-only, not read) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119964

## From the sources

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_