CVE-2026-50439 is a use after free (CWE-416) in the Microsoft Message Queuing (MSMQ) Queue Manager that can let an unauthorized attacker execute code over a network. NVD scores it 8.1 high. Install the Microsoft update for your Windows build, and disable the Message Queuing feature if nothing needs it.
What's affected
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 24H2, 25H2 and 26H1, and Windows Server 2012, among others. It does not give the update numbers, since Microsoft's page loads dynamically.
The vector is network based and rated high complexity, with no privileges and no user interaction. Only systems with the Message Queuing component installed are in play, which is not the default on most machines.
How to check if you're exposed
First see whether MSMQ is present. In an elevated PowerShell prompt:
Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
Get-Service MSMQ
If the feature is disabled and the service does not exist, this CVE does not apply. For installed systems, list updates with Get-HotFix and compare with the update Microsoft names for your build in its advisory.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Inventory servers and workstations that run the Message Queuing service.
- Open the Microsoft advisory for this CVE and note the update for each Windows build you run.
- Install the update, starting with systems reachable from other networks.
- Remove the Message Queuing feature where no application needs it.
- Block inbound MSMQ traffic at the network edge for hosts that do not need it.
Why it matters
A use after free (CWE-416) means memory is used after it has been released, so an attacker who controls what lands in that space can steer the program. In a network service the result can be remote code execution.
The record rates attack complexity high, which usually means exploitation depends on conditions the attacker does not control. It does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. Reducing the services you run is still the cheapest defense.
Quick check
Do I need MSMQ at all?
Only if an application depends on it. Many older line of business apps do. Check before you remove it.
Is the flaw exploited in the wild?
The record does not say so and it is not marked as a CISA KEV entry. Check Microsoft's advisory for any later change.
Sources
Last reviewed: 19 October 2026.
