{"id":"CVE-2026-119967","kind":"vulnerability","aliases":["CVE-2026-119967"],"related":[],"title":"Windows Message Queuing: use-after-free lets unauthenticated network attacker run code","description":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","summary":"Windows Message Queuing's Queue Manager has a use-after-free memory bug. A remote attacker with no account can send crafted network traffic to run code on the affected Windows machine.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/Server 2016 (1607)","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"windows"},{"name":"Windows 10/Server 2019 (1809)","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"windows"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"windows"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"windows"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"windows"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"windows"}],"ecosystems":[],"tags":["infrastructure","message-queuing","msmq","network","unauthenticated","windows","windows-server"],"not_affected_if":["msmq-not-installed"],"how_to_check":"On each Windows host, check whether Message Queuing is installed: PowerShell 'Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server' (servers: 'Get-WindowsFeature MSMQ'), or look for the 'Message Queuing' service (MSMQ) and a listener on TCP 1801. If present, compare the build ([System.Environment]::OSVersion.Version or 'winver') with the fixed builds in the fix field. Not installed means not exposed.","fix":"Install the November 2026 Windows cumulative update so the build is at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not read.","status":"open","published_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:34:39+00:00","updated_at":"2026-11-10T22:12:18+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:34:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Message Queuing: use-after-free lets unauthenticated network attacker run code","impact":"high","summary":"Windows Message Queuing's Queue Manager has a use-after-free memory bug. A remote attacker with no account can send crafted network traffic to run code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","msmq","message-queuing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows server over the network","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-119967 to get affected Windows builds, the default state of MSMQ, and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["msmq-not-installed"],"who_is_affected":"Windows machines with the Message Queuing (MSMQ) feature installed and reachable over the network are the ones to examine. The sources do not say which Windows versions or configurations are affected, or whether the feature is on by default. Systems without MSMQ installed are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4492,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-119967 to get affected Windows builds, the default state of MSMQ, and the patch.","search":"'-119967':16A,19A '-2026':15A,18A '10':29A '10/server':21A,25A '11':32A '1607':23A '1809':27A '2016':22A '2019':26A '2022':36A '2025':39A '22h2':30A '24h2':33A 'account':70B 'affect':81B 'allow':93C 'attack':11A,67B,96C 'bug':64B 'code':13A,78B,99C 'craft':73B 'cve':14A,17A 'execut':98C 'free':7A,62B,86C 'infrastructur':40B 'let':8A 'machin':83B 'manag':56B,92C 'memori':63B 'messag':2A,42B,52B,89C 'message-queu':41B 'msmq':44B 'network':10A,45B,74B,102C 'queu':3A,43B,53B,90C 'queue':55B,91C 'remot':66B 'run':12A,77B 'send':72B 'server':35A,38A,50B 'traffic':75B 'unauthent':9A,46B 'unauthor':95C 'use':5A,60B,84C 'use-after-fre':4A,59B 'window':1A,47B,49B,51B,82B,88C 'windows':20A,24A,28A,31A,34A,37A 'windows-serv':48B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Message Queuing (MSMQ) feature installed and reachable over the network, on the Windows 10, Windows 11 and Windows Server 2016-2025 builds below the November 2026 fixed builds. Microsoft rates it CVSS 8.1 (high attack complexity, no authentication, no user interaction). Hosts without MSMQ, or with MSMQ not reachable from untrusted networks, can skip it until patched in the normal cycle.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","10server20161607","10server20191809","1124h2","server2022","server2025","windows1022h2","windows10server20161607","windows10server20191809","windows1124h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","22h2","24h2","server","windows"],"labels":["high","infrastructure","messagequeuing","msmq","network","unauthenticated","windows","windowsserver"],"campaign_type":null,"search_a":"'-119967':16A,19A '-2026':15A,18A '10':29A '10/server':21A,25A '11':32A '1607':23A '1809':27A '2016':22A '2019':26A '2022':36A '2025':39A '22h2':30A '24h2':33A 'attack':11A 'code':13A 'cve':14A,17A 'free':7A 'let':8A 'messag':2A 'network':10A 'queu':3A 'run':12A 'server':35A,38A 'unauthent':9A 'use':5A 'use-after-fre':4A 'window':1A 'windows':20A,24A,28A,31A,34A,37A","search_b":"'account':70B 'affect':81B 'attack':67B 'bug':64B 'code':78B 'craft':73B 'free':62B 'infrastructur':40B 'machin':83B 'manag':56B 'memori':63B 'messag':42B,52B 'message-queu':41B 'msmq':44B 'network':45B,74B 'queu':43B,53B 'queue':55B 'remot':66B 'run':77B 'send':72B 'server':50B 'traffic':75B 'unauthent':46B 'use':60B 'use-after-fre':59B 'window':47B,49B,51B,82B 'windows-serv':48B","search_c":"'allow':93C 'attack':96C 'code':99C 'execut':98C 'free':86C 'manag':92C 'messag':89C 'network':102C 'queu':90C 'queue':91C 'unauthor':95C 'use':84C 'window':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119967","severity":null,"published_at":"2026-11-10T19:20:21+00:00","modified_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119967:2937","url":"https://nvd.nist.gov/vuln/detail/cve-2026-119967","severity":null,"published_at":"2026-11-10T22:12:18+00:00","modified_at":"2026-11-10T22:12:18+00:00","first_seen_at":"2026-11-10T22:12:18+00:00","fetched_at":"2026-11-10T22:12:18+00:00","note":"Microsoft's MSRC page is JS-only and unreadable here; affected builds/fixed builds taken from Microsoft CNA data mirrored on NVD, so nothing marked verified. Not exploited per ZDI (only CVE-2026-124194 is). KB numbers and MSMQ default state not read.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-119967","https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review"]}],"documents":[{"id":119415,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-119967","title":"NVD: CVE-2026-119967 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119332,"url":"https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review","title":"ZDI: November 2026 Security Update Review","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}