CVE-2026-54992 PoC

Proof of concept for the Microsoft Message Queuing remote-read integer overflow tracked as CVE-2026-54992.

The PoC uses two Windows VMs. A normal user on the vulnerable target asks the local MSMQ service to read from a queue hosted by the helper. The helper returns a malformed MS-MQRR response, causing mqsvc.exe on the target to crash. The PoC demonstrates denial of service; it does not demonstrate code execution.

Root cause

mqqm.dll validates each returned packet section separately but, on affected versions, sums their allocation lengths using a 32-bit value without checking for aggregate overflow. This PoC supplies section lengths 0x2000 and 0xffffe010. Their mathematical sum is 0x100000010, which wraps to 0x10. MSMQ allocates packet storage using the wrapped size and then processes the original section lengths, resulting in an out-of-bounds write.

Build

Build the two x64 binaries with MinGW-w64, then copy the folder to both Windows VMs:

make clean all

Run

Use two disposable Windows VMs on an isolated network. The helper and the real MSMQ service both use TCP port 2105, so they must run on separate machines.

On the vulnerable target, run from an elevated PowerShell window:

Set-ExecutionPolicy -Scope Process Bypass
.\setup-target.ps1

On the helper VM, run from an elevated PowerShell window:

Set-ExecutionPolicy -Scope Process Bypass
.\start-emulator.ps1

Then, on the target, run from a normal non-elevated PowerShell window, replacing the address with the helper VM's IPv4 address:

.\invoke-crash.ps1 -Server 192.168.122.53 -IUnderstandThisWillCrashMSMQ

On an affected build, mqsvc.exe terminates and MSMQ stops with service exit code 1067. To reset the lab, run restore-helper.ps1 on the helper and restart MSMQ on the target.