CVE-2026-50447
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker can remotely execute malicious code on a server running MSMQ, leading to system takeover.
Recommendation
Install the security patch from Microsoft for Windows Message Queuing.
Other vulnerabilities in Windows Message Queuing
See all- CVE-2026-34329High
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
- CVE-2026-33838High
CVE-2026-33838 is a vulnerability related to double free in Windows Message Queuing, allowing an authorized attacker to elevate privileges locally.
- CVE-2026-100202Critical
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
- CVE-2026-69579Critical
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-85874High
Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally.
- CVE-2026-85859Medium
A null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network.
- CVE-2026-108460High
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-83997High
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
- CVE-2026-72932High
Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
- CVE-2026-69645High
Use-after-free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS