Micropatches released for Microsoft Message Queuing Queue Manager Remote Code Execution (CVE-2026-54992)

Mitja KolsekSep 22, 2026
Micropatches released for Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability (CVE-2026-54992)

July 2026 Windows Updates brought a patch for CVE-2026-54992, a remote code execution vulnerability in Windows Message Queuing Queue Manager, allowing an attacker to set up a malicious server and have their code executed as Local System on any computer connecting to it with message queuing client.

The vulnerability was found by Seung Chan Kim, who reported it to Microsoft. Subsequently, David Carliez published their own proof of concept, which allowed us to reproduce the issue and create patches for legacy Windows systems.

The Vulnerability 

This is a numeric overflow issue, triggered by a malformed "RemoteRead" message queuing response that contains a number of sections whose cumulative size exceeds 2^32 bytes - leading to an allocation of a buffer that is too small for the actual data. Consequently, a buffer overflow occurs when this data is copied to the buffer, corrupting adjacent memory locations.

There was a validation code there to prevent various violations in the received data, but it was per-section and did not check the cumulative size of all sections.

In order to exploit this issue, the attacker would have to somehow get an application using Message Queuing for connecting to a remote message queue to connect to attacker's machine instead - perhaps through DNS or ARP spoofing in the local network.

Microsoft's Patch

Microsoft fixed this issue by adding a check for the numeric overflow.

Our Patch

Our patch is logically identical to Microsoft's.

Let's see our patch in action. Attacker (computer on the right) has a malicious message queuing service running that sends a malformed response to every remote client request. With 0patch disabled, a vulnerable Windows 11 computer (on the left) runs a script exploying the local MMQ service to connect to attacker's queue, causing the service to promptly crash.

With 0patch enabled, the MMQ service on user's computer does not crash.

Micropatch Availability

Micropatches were written for the following security-adopted Windows versions:

  1. Windows 11 v22H2 - fully updated

  2. Windows 11 v21H2 - fully updated

  3. Windows 10 v22H2 - fully updated

  4. Windows 10 v21H2 - fully updated

  5. Windows 10 v21H1 - fully updated

  6. Windows 10 v20H2 - fully updated

  7. Windows 10 v2004 - fully updated

  8. Windows 10 v1909 - fully updated

  9. Windows 10 v1809 - fully updated

  10. Windows 10 v1803 - fully updated

  11. Windows 7 - fully updated with no ESU, with ESU 1, ESU 2 or ESU 3

  12. Windows Server 2008 R2 - fully updated with no ESU, with ESU 1, ESU 2, ESU 3 or ESU 4

  13. Windows Server 2012 - fully updated with no ESU, with ESU 1

  14. Windows Server 2012 R2 - fully updated with no ESU, with ESU 1

 

Micropatches have already been distributed to, and applied on, all affected online computers with 0patch Agent in PRO or Enterprise accounts (unless Enterprise group settings prevented that).

Vulnerabilities like these get discovered on a regular basis, and attackers know about them all. If you're using Windows that aren't receiving official security updates anymore, 0patch will make sure these vulnerabilities won't be exploited on your computers - and you won't even have to know or care about these things. 

We'd like to thank David Carliez for sharing their proof-of-concept, which allowed us to create patches for Windows versions that are no longer receiving official updates from Microsoft.

If you're new to 0patch, create a free account in 0patch Central, start a free trial, then install and register 0patch Agent. Everything else will happen automatically. No computer reboot will be needed.

Did you know 0patch security-adopted Windows 10 and Office 2016 and 2019 when they went out of support in October 2025, allowing you to keep using them for at least 3 more years (5 years for Windows 10)? Read more about it here and here. 

Note that we will soon security-adopt the following products:

  1. Windows 10 22H2 with Extended Security Updates year 1: October 2026

  2. Windows Server 2012 with Extended Security Updates year 3: October 2026

  3. Windows Server 2012 R2 with Extended Security Updates year 3: October 2026

  4. Microsoft Office 2021: October 2026

  5. Windows 11 23H2 (E): November 2026

  6. Windows Server 2016: January 2027

To learn more about 0patch, please visit our Help Center.