External risk intelligence

Microsoft MSMQ Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-35385

Microsoft Message Queuing (MSMQ) is a Windows service typically used for internal application-to-application communication within a local network or domain. While it can be configured to be network-reachable, it is rarely exposed directly to the public internet in common deployments and is usually protected by internal network controls.

Integer Overflow

Microsoft Windows 10 1507

before 10.0.10240.20107before 10.0.14393.6167before 10.0.17763.4737before 10.0.19044.3324before 10.0.19045.3324before 10.0.22000.2295before 10.0.22621.2134r2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft Message Queuing (MSMQ) that could allow unauthorized remote code execution. MSMQ is a Windows component used for application communication, and this flaw presents a significant risk if exploited. The main concern at this time is confirming whether your environment utilizes this specific technology.

Remote code execution flaw in Windows messaging.
Understand if this messaging service is used.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target Microsoft Message Queuing (MSMQ) by sending specially crafted messages over the network. This vulnerability could allow an attacker to achieve remote code execution on the affected system.

Network access required to reach MSMQ.
Specially crafted messages trigger the vulnerability.
Remote code execution is the potential risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Microsoft Message Queuing (MSMQ) could allow an unauthenticated attacker to execute arbitrary code remotely when MSMQ is exposed to an attacker-controlled network. The attack could affect the availability and integrity of services that rely on MSMQ for communication.

System services could be compromised.
Unauthenticated remote network access may trigger.
Full system compromise is a possible outcome.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Microsoft Message Queuing (MSMQ) affects Windows operating systems and can be exploited remotely. Given MSMQ's typical role in internal application communication, infrastructure or platform teams are likely responsible for its management. The first practical step is to identify all systems running MSMQ, confirm their network exposure and business criticality, identify the accountable owner for each instance, and then prioritize remediation efforts based on assessed risk.

Identify MSMQ instances and owners.
Verify network exposure and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Message Queuing (MSMQ) used for?

Microsoft Message Queuing is a Windows feature that allows separate applications to communicate reliably by sending and receiving messages. It acts as a middleman, letting programs exchange data even if they are not running at the same time or are on different parts of a network. It is frequently employed in enterprise environments to support background processing, workflow coordination, and data synchronization between services on various Windows systems.

How does CVE-2023-35385 work?

This vulnerability is classified as an integer overflow, represented by CWE-190. In simple terms, the software performs a calculation that results in a value larger than what it can handle, causing memory errors. By sending a specially crafted message to the MSMQ service, an attacker can manipulate these memory operations. This process allows them to bypass normal security controls and execute arbitrary commands on the target computer without needing a legitimate user account.

What is required to trigger this vulnerability?

An attacker needs network access to reach the MSMQ service. The attack is triggered by sending a malformed message designed to exploit the memory handling flaw. It is important to note that if the MSMQ service is disabled or not running on a Windows system, the vulnerability cannot be triggered, as there is no active service to process the malicious network traffic.

Is my system at risk?

According to Halo Surface Signal, MSMQ is typically designed for internal communication within a local network or domain and is rarely intended to be reached directly from the public internet. While it is technically possible for the service to be network-reachable, its primary risk stems from environments where it is exposed to untrusted segments. You should evaluate whether your MSMQ instances are accessible to unauthorized users or outside the protection of your internal network controls.

How do I respond to this vulnerability?

Your first step is to perform an inventory to identify all systems in your environment that have the MSMQ component enabled. Once you have a list, work with your infrastructure teams to determine which systems are business-critical and which ones have network exposure. After mapping these, prioritize applying official security updates from the vendor to the most critical or exposed instances to mitigate the risk of remote code execution.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35385

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.