A use‑after‑free issue in the Windows Message Queuing Queue Manager allows an unauthorized attacker to execute arbitrary code on the target system. The flaw occurs when the manager frees a memory buffer and then later accesses that buffer, which can be triggered by specially crafted network messages. This vulnerability is classified as CWE‑416 and grants a remote attacker full control over the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including core installations.

The CVSS score of 9.8 indicates critical severity, and the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the Message Queuing service, making it exploitable over the network by an attacker who can send malicious messages to the queue manager.