davidcarliez/cve-2026-54992-pocProof of concept for CVE-2026-54992, an MSMQ remote-read integer overflow
Proof of concept for the Microsoft Message Queuing remote-read integer overflow tracked as CVE-2026-54992.
The PoC uses two Windows VMs. A normal user on the vulnerable target asks the
local MSMQ service to read from a queue hosted by the helper. The helper returns
a malformed MS-MQRR response, causing mqsvc.exe on the target to crash. The
PoC demonstrates denial of service; it does not demonstrate code execution.
mqqm.dll validates each returned packet section separately but, on affected
versions, sums their allocation lengths using a 32-bit value without checking
for aggregate overflow. This PoC supplies section lengths 0x2000 and
0xffffe010. Their mathematical sum is 0x100000010, which wraps to 0x10.
MSMQ allocates packet storage using the wrapped size and then processes the
original section lengths, resulting in an out-of-bounds write.
Build the two x64 binaries with MinGW-w64, then copy the folder to both Windows VMs:
make clean all
Use two disposable Windows VMs on an isolated network. The helper and the real MSMQ service both use TCP port 2105, so they must run on separate machines.
On the vulnerable target, run from an elevated PowerShell window:
Set-ExecutionPolicy -Scope Process Bypass
.\setup-target.ps1
On the helper VM, run from an elevated PowerShell window:
Set-ExecutionPolicy -Scope Process Bypass
.\start-emulator.ps1
Then, on the target, run from a normal non-elevated PowerShell window, replacing the address with the helper VM's IPv4 address:
.\invoke-crash.ps1 -Server 192.168.122.53 -IUnderstandThisWillCrashMSMQ
On an affected build, mqsvc.exe terminates and MSMQ stops with service exit
code 1067. To reset the lab, run restore-helper.ps1 on the helper and restart
MSMQ on the target.