External risk intelligence

Microsoft Message Queuing Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-36910

Microsoft Message Queuing (MSMQ) is a Windows service typically deployed within internal networks to facilitate asynchronous communication between applications. While network-reachable in some environments, it is rarely exposed directly to the public internet by design, generally residing behind internal controls and firewalls in standard enterprise deployments.

Integer Overflow

Microsoft Windows 10

before 10.0.10240.20107before 10.0.14393.6167before 10.0.17763.4737before 10.0.19044.3324before 10.0.19045.3324before 10.0.22000.2295before 10.0.22621.2134r2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft Message Queuing (MSMQ) software that could allow unauthorized remote code execution. This issue affects various Windows operating systems and server products, potentially impacting systems that utilize MSMQ for inter-application communication. While the direct exposure of MSMQ to the internet is generally limited, its presence within internal networks warrants attention to confirm relevance and exposure.

A critical flaw allows remote code execution.
Confirms relevance and exposure for critical systems.
Assess risk and confirm usage of the affected service.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending a specially crafted message to a vulnerable Microsoft Message Queuing service over the network. This allows for remote code execution, potentially leading to the compromise of the affected system.

Network access required.
Triggered by sending a malicious message.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on affected systems. The attack could occur when the Microsoft Message Queuing (MSMQ) service is running and accessible over the network. This could lead to a complete compromise of the affected system.

System files and data could be accessed.
Network access to MSMQ service.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Microsoft Message Queuing (MSMQ) on various Windows versions. Given MSMQ's typical internal deployment, infrastructure or platform teams are likely responsible for managing this service. The first actionable step is to identify all MSMQ instances, confirm their reachability and business criticality, and then locate the accountable system owners to plan remediation.

Own the discovery and inventory of MSMQ.
Verify external exposure and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Message Queuing (MSMQ)?

MSMQ is a Windows service that allows different software applications to communicate reliably. It acts as a middleman, holding messages in a queue until the receiving application is ready to process them. This ensures that data can be exchanged even if systems are temporarily offline or busy, making it a standard component for many enterprise backend services across Windows client and server environments.

What does CVE-2023-36910 mean for my system?

This vulnerability is classified as an Integer Overflow (CWE-190). In simple terms, the software makes a calculation error when handling data, which can be manipulated to trigger unintended behavior. For CVE-2023-36910, this flaw allows an attacker to send a specially crafted message to the MSMQ service, potentially bypassing security controls to run their own unauthorized code on the system.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending a malicious message directly to the MSMQ service over a network. The service must be active and listening for incoming traffic for the attack to succeed. Importantly, the bug is not triggered by standard, legitimate application messages; it requires a carefully prepared payload designed to exploit the specific integer overflow weakness.

Why is this relevant to my organization?

While Halo Surface Signal identifies the attack vector as network-based, it notes that MSMQ is typically designed for internal communication and is rarely exposed to the public internet. However, if your systems are reachable over a network—even an internal one—they could be at risk. Organizations should prioritize systems where MSMQ is enabled and reachable, as these are the primary targets.

What should I do if I run this software?

Your first step is to perform a discovery exercise to identify where the MSMQ service is running in your environment. Once you have a clear inventory, determine which instances are business-critical and assess their network accessibility. Work with your system owners to review these instances, limit unnecessary network exposure, and prepare to apply official patches once they are integrated into your update cycle.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36910

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.