An attacker exploiting a use‑after‑free bug in the Windows Message Queuing (MSMQ) implementation can cause the system to execute arbitrary code. Once the vulnerable memory region is reused, malicious input can be injected to alter program behavior, allowing the attacker to gain arbitrary code execution on the compromised host. The flaw enables control over the affected machine’s memory management, potentially leading to privilege escalation, data theft, or system disruption. The weakness corresponds to CWE-416, where an object is destroyed and then accessed.

The vulnerability affects multiple Microsoft Windows operating systems as identified by the CNA. Clients running Windows 10 build 1607, 1809, 21H2, or 22H2, and Windows 11 build 23H2, 24H2, 25H2, or 26H1 are susceptible. It also affects server editions: Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full installations and Server Core deployments. Each of these OS versions contains the MSMQ service component that is vulnerable.

The CVSS base score of 9.8 indicates a high‑severity remote code execution potential. EPSS data is unavailable, but the lack of listing in the CISA KEV catalog does not diminish the risk of exploitation. The attack is likely carried out remotely over the network, as stated in the description, by sending specifically crafted MSMQ messages to the target. Once the use‑after‑free condition is triggered, the attacker can execute arbitrary code with the privileges of the MSMQ service, which may then be leveraged for further compromise.