The vulnerability is a use‑after‑free flaw (CWE‑416) in the Windows Message Queuing (MSMQ) service that allows an authorized attacker to execute arbitrary code on the target machine. The flaw arises from improper memory handling when processing network messages, enabling the attacker to trigger execution of attacker‑controlled code. The result is a full compromise of the affected system, giving the attacker control over its confidentiality, integrity, and availability.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including standard and Server Core installations. All these operating systems contain the MSMQ component, which is the attack surface.

The CVSS score of 7.5 reflects high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. Microsoft does not list this vulnerability in its KEV catalog, suggesting no active exploitation campaigns. Nevertheless, the flaw allows remote code execution from a network source; an attacker who can reach the target and has access to MSMQ, either by being an authenticated user or having write permissions on the MSMQ infrastructure, could potentially compromise the machine. The likely attack vector is a network attacker sending crafted MSMQ messages, as inferred from the description.