Win10/11 MQ Use-After-Free: Critical Unauthenticated RCE Flaw Affects Multiple Builds with 9.8 CVSS Score

Microsoft has identified a critical remote code execution vulnerability within the Windows Message Queuing Queue Manager component, designated as CVE-2026-100202. This security flaw allows an unauthorised attacker to execute arbitrary code on a target system over a network connection without needing any form of authentication. The issue stems from a use-after-free memory corruption error, which occurs when the software attempts to access memory that has already been freed or deallocated. According to the National Vulnerability Database, this weakness is classified under CWE-416 and carries a CVSS score of 9.8, indicating a critical severity level for affected installations.

Root cause

The underlying technical issue is a use-after-free vulnerability within the Windows Message Queuing Queue Manager. This type of memory management error happens when a program continues to use a pointer to a memory location after that memory has been released back to the system. In this specific instance, the flaw exists in how the Queue Manager handles memory operations, allowing an attacker to manipulate the freed memory space.

By carefully crafting network requests, an adversary can exploit this mismanagement to overwrite critical data structures or redirect execution flow. The Microsoft Security Update Guide confirms that this memory corruption leads to remote code execution capabilities for unauthorised users.

Attack path

An attacker can exploit this vulnerability remotely over a standard network connection, without needing to authenticate to the system first. The exploit vector involves sending specially crafted data to the Windows Message Queuing service, triggering the use-after-free condition in the Queue Manager. Once the memory corruption occurs, the attacker can potentially execute arbitrary code with the privileges of the service account running the Message Queuing component. This unauthenticated access path significantly lowers the barrier for exploitation, as no valid user credentials or prior access are required to initiate the attack against vulnerable endpoints.

Affected versions

• Microsoft Windows 10 Version 1607 before build 10.0.14393.9612
• Microsoft Windows 10 Version 1809 before build 10.0.17763.9376
• Microsoft Windows 10 Version 21H2 before build 10.0.19044.7807
• Microsoft Windows 10 Version 22H2 before build 10.0.19044.7807
• Microsoft Windows 11 Version 23H2 before build 10.0.22631.7652

Mitigation

• Verify current Windows build numbers against the affected versions listed in the advisory.
• Ensure that Windows Message Queuing is not exposed to untrusted networks or the internet.
• Apply the latest security updates provided by Microsoft once they are available for your specific build.
• Monitor network traffic for unusual activity targeting the Message Queuing service ports.

Why it matters

Teams should understand that use-after-free errors are dangerous memory corruption flaws that can allow attackers to take control of a system. Remote code execution without authentication means an attacker does not need a password or user account to exploit the vulnerability, making it accessible to anyone with network access.

Security operations teams usually prioritise patching such critical flaws immediately, especially when the attack path is remote and unauthenticated. Checking whether the Message Queuing service is enabled and necessary for business operations is a standard step, as disabling unused services reduces the attack surface and limits potential exposure to these types of memory-based exploits.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Microsoft

• Audit your environment to identify all systems running the affected Windows builds listed in the advisory.
• Restrict network access to the Windows Message Queuing service ports to only trusted internal networks.
• Monitor system logs for unexpected process executions or memory access violations related to the Queue Manager.
• Plan for immediate patching once Microsoft releases the confirmed security update for your specific version.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-100202?

The CVSS score is 9.8, which is rated as critical severity.

Does this vulnerability require authentication to exploit?

No, the vulnerability allows an unauthorised attacker to execute code without authentication.

Which Windows versions are affected by this flaw?

Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 version 23H2, are affected if they are below the specified build numbers.