CVE-2024-49122

CVE-2024-49122 is a remote code execution vulnerability in Microsoft Message Queuing (MSMQ), a legacy optional Windows messaging component, caused by a use-after-free condition (CWE-416) reached through a race condition (CWE-362). A remote, unauthenticated attacker can trigger the flaw by sending specially crafted network traffic to a host with the MSMQ feature enabled; the high attack complexity (CVSS 8.1, AC:H) reflects timing-sensitive race-condition exploitation, with no privileges or user interaction required. Successful exploitation yields code execution on the target host with high impact on confidentiality, integrity, and availability, and can serve as a foothold for lateral movement. Affected organizations are those running the listed Windows 10/11 client or Windows Server versions with the MSMQ feature installed and running. As of the December 2024 disclosure there is no known public PoC, the flaw is not yet in CISA KEV, but the EPSS score of 20.4% (97th percentile) indicates an elevated likelihood of exploitation within 30 days.

What to do: Apply the December 2024 Patch Tuesday security updates for the affected Windows 10, Windows 11, and Windows Server versions. Audit hosts for the MSMQ feature (e.g., check installed optional features and whether TCP port 1801 is listening) and disable or remove MSMQ where it is not required; prioritize patching internet-exposed or legacy Windows Server systems, and note that Windows Server 2008/2012 devices may require extended-security-update channels.