A heap‑based buffer overflow exists in the Windows Message Queuing Queue Manager and allows an attacker who sends malformed queue data to execute code locally. The flaw is a classic Buffer Overflow weakness (CWE‑122).

The issue affects Microsoft Windows 10 from version 1607 through 22H2 (both x86 and x64), Windows 11 from version 24H2 through 26H1 (arm64 and x64), and Microsoft Windows Server from 2012 through 2025, including Server Core installations. The CPE list confirms support for x86, x64 and arm64 architectures in this vulnerability.

The CVSS severity of 8.4 indicates a high‑risk flaw, yet the EPSS score of less than 1 % suggests that exploitation in the wild is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no known publicly available exploits. The attack requires local access to the Message Queuing service; an attacker must be able to deliver crafted data to a target queue to trigger the overflow and achieve local code execution.