OnlyPatch
Windows Message Queuing

CVE-2025-62455 — Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00477 🔬 Patch diffed 2025-12 archive

Executive Summary

Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-20: Improper Input Validation
Released Dec 9 2025
Last Updated Dec 9 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00477 — 0.38569 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00477
probability of exploitation in the next 30 days
0.38569 percentile - updated 2026-07-25
View on FIRST.org

Affected Products

18 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5071543 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5071543 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5071544 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5071544 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5071501 (Monthly Rollup) 5071506 (Security Only) Important Elevation of Privilege 5068904 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.28064 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5071501 (Monthly Rollup) 5071506 (Security Only) Important Elevation of Privilege 5068904 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.28064 Yes None Windows Server 2012 5071505 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5071505 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5071503 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5071503 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5071543 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5071543 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5071544 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5071544 (Security Update) Important Elevation of Privilege Yes

Patches

5 patches
Article Type Restart
5071543 Security Update Yes
5071544 Security Update Yes
5071546 Security Update Yes
5071505 Monthly Rollup Yes
5071503 Monthly Rollup Yes

Patch Diff

ghidriff (PDB symbols resolved from Microsoft symbol server) · mqac.sys (KB5071544)

CVE-2025-62455 patch (KB5071544, December 9 2025) fixes an arbitrary file write in mqac.sys (MSMQ kernel driver) via feature flag gating. Root cause: ACpCreateBitmap and CMMFAllocator::Create both called ZwCreateFile with a DOS path (C:\Windows\System32\msmq\storage\l%07u.mq) resolved through the calling process device map (_EPROCESS.DeviceMap) with OBJECT_ATTRIBUTES.Attributes = 0x240 (OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE). Any unprivileged process can redirect this via NtSetInformationProcess(ProcessDeviceMap) to cause SYSTEM-level file creation at an attacker-chosen path. Patch: both functions now call EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) before ZwCreateFile. When the feature flag is enabled, Attributes is changed to 0x640 (adds OBJ_FORCE_ACCESS_CHECK 0x400). Deployment uses Microsoft feature experimentation rollout (same gradual-deployment pattern as CLFS.sys patches) for kill-switch capability. ZwCreateFile and the DOS path remain in both versions — the fix is in the Attributes field, not path removal. Secondary error handling updated to distinguish STATUS_ACCESS_DENIED (0xC0000022) from other failures, suggesting the new flag is expected to produce access-denied errors in exploit scenarios. 3 functions changed (code), 1 changed (address only), 1139 functions unchanged.

Pre-patch version 10.0.17763.7919 Download
Post-patch version 10.0.17763.8146 Download
Function Address Change Note
CMMFAllocator::Create 1c001001c → 1c000f0a4 code, length, address 906 → 1115 bytes (+209 bytes, 74% match). Primary patch site alongside ACpCreateBitmap. Feature flag EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) added twice: before ZwCreateFile to gate OBJECT_ATTRIBUTES.Attributes (0x240 → 0x640 when enabled, adding OBJ_FORCE_ACCESS_CHECK 0x400) and after ZwCreateFile to gate extended WPP error logging. ZwCreateFile call and DOS path remain present in both versions.
ACpCreateBitmap 1c0010de4 → 1c000f76c code, length, address 439 → 626 bytes (+187 bytes, 78% match). Feature flag EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) added twice. OBJECT_ATTRIBUTES.Attributes changes from hardcoded 0x240 (OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE) to 0x640 (adds OBJ_FORCE_ACCESS_CHECK 0x400) when feature enabled. ZwCreateFile remains in both versions. Error path now distinguishes STATUS_ACCESS_DENIED (0xC0000022) with separate WPP_SF_SD message ID 0xf vs other failures (message ID 0x10), suggesting the feature flag change is expected to produce access-denied errors during testing. Early-return refactoring of null-check paths (no functional change to success path).
WPP_SF_S 1c000fcac → 1c000fdf4 code, refcount, length, sig, address, calling 116 → 114 bytes (96% match, minor). Now called by both ACpCreateBitmap and CMMFAllocator::Create (refcount 2 → 4). Signature param_2 type changed from undefined8 to undefined2. WPP trace GUID changed (WPP_513747e657fd3457b90b087b9bdb6357_Traceguids → WPP_6abace7bf7993bf0a051e292fbd0c98c_Traceguids), consistent with recompile updating trace registration.
View full diff report View RCA report Download PoC

Known Exploits

Acknowledgments

T0

On This Page