CVE-2025-21277

Microsoft Message Queuing (MSMQ) — the optional Windows messaging component used by enterprise and legacy applications — contains a buffer over-read (CWE-126) that an unauthenticated remote attacker can trigger by sending specially crafted messages to the MSMQ service, which listens on the network (typically TCP 1801) on systems where the feature is enabled. Successful exploitation carries a high availability impact only: the queuing service can crash or stop responding, disrupting applications that depend on it, with no confidentiality or integrity impact per the CVSS vector. Any affected Windows 10, Windows 11, or Windows Server release with the MSMQ feature installed is exposed, although the component is not enabled by default on most systems. Exploitation has not yet been observed in the wild, no public proof-of-concept is known, and the flaw is not in CISA's KEV; however, its EPSS of 38.6% (98th percentile) indicates a comparatively high likelihood of exploitation within the next 30 days.

What to do: Apply Microsoft's security update for MSMQ on all affected Windows 10/11 and Windows Server builds, prioritizing servers with MSMQ reachable from untrusted networks. Until patched, restrict network access to the MSMQ service (TCP 1801 and associated MSMQ ports) to trusted hosts, or disable the optional MSMQ feature where it is not required — check installation state with 'Get-WindowsFeature MSMQ' on Server or 'optionalfeatures.exe' on clients. No public PoC or in-the-wild exploitation is known yet, but the elevated EPSS warrants prompt patching.