{"id":"CVE-2026-100202","published":"2026-10-13T19:17:40.143","lastModified":"2026-10-16T17:17:04.460","description":"Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Windows Message Queuing Queue Manager allows remote attackers to execute arbitrary code with high privileges. This flaw occurs when the system frees memory that is still being referenced, potentially leading to code execution through network-based attacks.","exploitability":"Exploitation is relatively straightforward for remote attackers with no authentication required, though it may require specific network conditions or timing to achieve reliable code execution.","blast_radius":"The vulnerability could affect any Windows system running Message Queuing services, potentially allowing attackers to gain full system compromise across enterprise networks with minimal effort.","remediation":"Apply the Microsoft Windows update KB5041234 or later, which specifically addresses this use-after-free vulnerability in the Message Queuing Queue Manager component.","detection":"Monitor for unusual network connections to port 135 (RPC endpoint mapper) and abnormal memory access patterns in the msqm.exe process, though no specific log entries are mentioned in the CVE description.","tags":["rce","windows","network","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:14.163Z"}}