OnlyPatch
Windows Message Queuing

CVE-2025-62455 — Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.0048 🔬 Patch diffed 2025-12 archive

Executive Summary

Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-20: Improper Input Validation
Released Dec 9 2025
Last Updated Dec 9 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.0048 — 0.39242 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.0048
probability of exploitation in the next 30 days
0.39242 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

18 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5071543 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5071543 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5071544 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5071544 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5071546 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5071504 (Monthly Rollup) 5071507 (Security Only) Important Elevation of Privilege 5068906 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23666 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5071501 (Monthly Rollup) 5071506 (Security Only) Important Elevation of Privilege 5068904 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.28064 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5071501 (Monthly Rollup) 5071506 (Security Only) Important Elevation of Privilege 5068904 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.28064 Yes None Windows Server 2012 5071505 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5071505 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5071503 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5071503 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5071543 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5071543 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5071544 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5071544 (Security Update) Important Elevation of Privilege Yes

Patches

5 patches
Article Type Restart
5071543 Security Update Yes
5071544 Security Update Yes
5071546 Security Update Yes
5071505 Monthly Rollup Yes
5071503 Monthly Rollup Yes

Patch Diff

ghidriff (PDB symbols resolved from Microsoft symbol server) · mqac.sys (KB5071544)

CVE-2025-62455 patch (KB5071544, December 9 2025) fixes an arbitrary file write in mqac.sys (MSMQ kernel driver) via feature flag gating. Root cause: ACpCreateBitmap and CMMFAllocator::Create both called ZwCreateFile with a DOS path (C:\Windows\System32\msmq\storage\l%07u.mq) resolved through the calling process device map (_EPROCESS.DeviceMap) with OBJECT_ATTRIBUTES.Attributes = 0x240 (OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE). Any unprivileged process can redirect this via NtSetInformationProcess(ProcessDeviceMap) to cause SYSTEM-level file creation at an attacker-chosen path. Patch: both functions now call EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) before ZwCreateFile. When the feature flag is enabled, Attributes is changed to 0x640 (adds OBJ_FORCE_ACCESS_CHECK 0x400). Deployment uses Microsoft feature experimentation rollout (same gradual-deployment pattern as CLFS.sys patches) for kill-switch capability. ZwCreateFile and the DOS path remain in both versions — the fix is in the Attributes field, not path removal. Secondary error handling updated to distinguish STATUS_ACCESS_DENIED (0xC0000022) from other failures, suggesting the new flag is expected to produce access-denied errors in exploit scenarios. 3 functions changed (code), 1 changed (address only), 1139 functions unchanged.

Pre-patch version 10.0.17763.7919 Download
Post-patch version 10.0.17763.8146 Download
Function Address Change Note
CMMFAllocator::Create 1c001001c → 1c000f0a4 code, length, address 906 → 1115 bytes (+209 bytes, 74% match). Primary patch site alongside ACpCreateBitmap. Feature flag EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) added twice: before ZwCreateFile to gate OBJECT_ATTRIBUTES.Attributes (0x240 → 0x640 when enabled, adding OBJ_FORCE_ACCESS_CHECK 0x400) and after ZwCreateFile to gate extended WPP error logging. ZwCreateFile call and DOS path remain present in both versions.
ACpCreateBitmap 1c0010de4 → 1c000f76c code, length, address 439 → 626 bytes (+187 bytes, 78% match). Feature flag EvaluateCurrentState(g_Feature_1840809274_58536133_FeatureDescriptorDetails) added twice. OBJECT_ATTRIBUTES.Attributes changes from hardcoded 0x240 (OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE) to 0x640 (adds OBJ_FORCE_ACCESS_CHECK 0x400) when feature enabled. ZwCreateFile remains in both versions. Error path now distinguishes STATUS_ACCESS_DENIED (0xC0000022) with separate WPP_SF_SD message ID 0xf vs other failures (message ID 0x10), suggesting the feature flag change is expected to produce access-denied errors during testing. Early-return refactoring of null-check paths (no functional change to success path).
WPP_SF_S 1c000fcac → 1c000fdf4 code, refcount, length, sig, address, calling 116 → 114 bytes (96% match, minor). Now called by both ACpCreateBitmap and CMMFAllocator::Create (refcount 2 → 4). Signature param_2 type changed from undefined8 to undefined2. WPP trace GUID changed (WPP_513747e657fd3457b90b087b9bdb6357_Traceguids → WPP_6abace7bf7993bf0a051e292fbd0c98c_Traceguids), consistent with recompile updating trace registration.
View full diff report View RCA report Download PoC

Attack Path

Arbitrary file write as SYSTEM by hijacking the calling process device map used to resolve a DOS path in mqac.sys

Attack path for CVE-2025-62455 Arbitrary file write as SYSTEM by hijacking the calling process device map used to resolve a DOS path in mqac.sys 01 — ENTRY Local user with MSMQ installed sends or receives a queue message MQSendMessage / MQReceiveMessage (mqrt.dll) -> DeviceIoControl to \\.\MSMQ. Not default on client SKUs but common on Server. Any low-privileged account. 02 — CONTROLLED INPUT Attacker redirects their own process device map before triggering the path NtSetInformationProcess(ProcessDeviceMap) repoints the DOS device namespace, so 'C:' resolves wherever the attacker chooses. 03 — PATH The IOCTL dispatch reaches the storage-file creation helpers ACDeviceControl -> IOCTL 0x19651407 ACAllocatePacket -> CPacket::Create, and the parallel CMMFAllocator::Create path. Both open C:\Windows\System32\msmq\storage\l%07u.mq. 04 — MISSING CHECK ZwCreateFile called with a DOS path resolved through the caller's device map, Attributes = 0x240 OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE with no OBJ_FORCE_ACCESS_CHECK, and a DOS-relative rather than an absolute NT path. The kernel resolves it under the attacker's redirected map. The patch gates the path behind a feature flag and resolves it safely. 05 — PRIMITIVE File creation and write anywhere on disk with SYSTEM authority The attacker chooses the destination; the content is MSMQ storage data. Sufficient for DLL planting or overwriting a privileged binary.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

T0

On This Page