CVE-2026-83997

CVE-2026-83997 is a use-after-free (CWE-416) vulnerability in Microsoft's Windows Message Queuing (MSMQ) service that permits an unauthenticated, remote attacker to execute arbitrary code over the network. It is triggered when the MSMQ service processes specially crafted network traffic that causes memory to be used after it has been freed, with the high attack-complexity rating (AC:H) indicating the attacker likely needs to win a timing or state race to land the free-then-use condition. Successful exploitation yields code execution in the context of the MSMQ service, with high confidentiality, integrity, and availability impact, meaning an attacker could take over the affected host. Only Windows systems that have the optional Message Queuing (MSMQ) feature installed and running are exposed, since MSMQ is not enabled by default on most Windows installations and is typically found on legacy application and queuing servers. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, EPSS is 0.5% (42nd percentile), and the two actively exploited zero-days mentioned in September 2026 Patch Tuesday headlines are separate issues fixed in the same release.

What to do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows, which include the fix for CVE-2026-83997, prioritizing servers where the Message Queuing (msmq/mqsvc) service is installed. Where MSMQ is not required, disable and remove the Message Queuing feature; where it is needed, restrict inbound access to MSMQ network ports from untrusted networks and verify the service is not exposed to the internet.