CVE-2023-36583: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVE-2023-36583 is a remote code execution vulnerability in Microsoft Message Queuing (MSMQ), rated Important by Microsoft, with a CVSS 3.1 base score of 7.3 (High). An attacker can exploit it by an attacker with local access, with low privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.82% probability of exploitation activity in the next 30 days, higher than 57% of all scored vulnerabilities. Microsoft released the fix on 10 October 2023 in the October 2023 Patch Tuesday, delivered through 15 security updates (KB5031361, KB5031364, KB5031358, KB5031356 and more). It affects 33 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2023-36583

Severity

High CVSS 7.3

Microsoft severity

Important

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-416

EPSS

0.82% (percentile 57%)

CISA KEV

Not listed

Released

10 October 2023

Last updated

10 October 2023

Patch Tuesday

October 2023 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2023-36583 at 7.3 (temporal 6.4) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

How could an attacker exploit this vulnerability?

Successful exploitation of this vulnerability could allow an authenticated domain user to remotely execute code on the target server. The attacker needs to convince a user on the target machine to connect to a malicious server or compromise a legitimate MSMQ server host and make it run as a malicious server.

Mitigations and workarounds

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors might be helpful in your situation:

The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel.

You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.

Affected products (33)

Windows

ESU

Security updates (15)

• KB5031361 (Security Update)
• KB5031364 (Security Update)
• KB5031358 (Security Update)
• KB5031356 (Security Update)
• KB5031354 (Security Update)
• KB5031377 (Security Update)
• KB5031362 (Security Update)
• KB5031416 (Monthly Rollup)
• KB5031411 (Security Only)
• KB5031408 (Monthly Rollup)
• KB5031441 (Security Only)
• KB5031442 (Monthly Rollup)
• KB5031427 (Security Only)
• KB5031419 (Monthly Rollup)
• KB5031407 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

7.3 (HIGH)

NVD weakness

CWE-416

Published to NVD

10 October 2023

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36583 (Patch, Vendor Advisory)
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36583 (Patch, Vendor Advisory)

Acknowledgments

• k0shl with Kunlun Lab

Revision history

Related vulnerabilities

Other Microsoft Message Queuing (MSMQ) vulnerabilities

• CVE-2026-34329: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.8, May 2026)
• CVE-2025-62455: Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (High, CVSS 7.8, December 2025)
• CVE-2025-53145: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.8, August 2025)
• CVE-2025-53144: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.8, August 2025)
• CVE-2025-53143: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.8, August 2025)
• CVE-2025-50177: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (High, CVSS 8.1, August 2025)
• CVE-2025-26641: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, April 2025)
• CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, February 2025)
• CVE-2025-21290: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, January 2025)
• CVE-2025-21289: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, January 2025)
• CVE-2025-21285: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, January 2025)
• CVE-2025-21277: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (High, CVSS 7.5, January 2025)

More from the October 2023 Patch Tuesday

• CVE-2023-36563: Microsoft WordPad Information Disclosure Vulnerability (Medium, CVSS 6.5, exploited)
• CVE-2023-44487: MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack (N/A, exploited)
• CVE-2023-35349: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2023-36434: Windows IIS Server Elevation of Privilege Vulnerability (Critical, CVSS 9.8)
• CVE-2023-36594: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2023-36731: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2023-36732: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2023-36743: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2023-41772: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2023-38171: Microsoft QUIC Denial of Service Vulnerability (High, CVSS 7.5)
• CVE-2023-36776: Win32k Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2023-38159: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: October 2023 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2023-36583
• NIST NVD: CVE-2023-36583
• CVE.org record: CVE-2023-36583