CVE-2025-21277: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

CVE-2025-21277 is a denial of service vulnerability in Microsoft Message Queuing (MSMQ), rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 39.06% probability of exploitation activity in the next 30 days, higher than 99% of all scored vulnerabilities. Microsoft released the fix on 14 January 2025 in the January 2025 Patch Tuesday, delivered through 14 security updates (KB5050008, KB5049983, KB5049981, KB5050021 and more). It affects 37 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2025-21277
Severity: High CVSS 7.5
Microsoft severity: Important
Impact: Denial of Service
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-126
EPSS: 39.06% (percentile 99%)
CISA KEV: Not listed
Released: 14 January 2025
Last updated: 14 January 2025
Patch Tuesday: January 2025 Patch Tuesday
Product families: Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-21277 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Frequently asked questions (Microsoft)

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of availability (A:H). What does that mean for this vulnerability?

An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).

Affected products (37)

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5050008	Security Update	10.0.17763.6775	Yes
Windows 10 Version 1809 for x64-based Systems	KB5050008	Security Update	10.0.17763.6775	Yes
Windows Server 2019	KB5050008	Security Update	10.0.17763.6775	Yes
Windows Server 2019 (Server Core installation)	KB5050008	Security Update	10.0.17763.6775	Yes
Windows Server 2022	KB5049983	Security Update	10.0.20348.3091	Yes
Windows Server 2022 (Server Core installation)	KB5049983	Security Update	10.0.20348.3091	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5049981	Security Update	10.0.19044.5371	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5049981	Security Update	10.0.19044.5371	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5049981	Security Update	10.0.19044.5371	Yes
Windows Server 2025 (Server Core installation)	KB5050009	Security Update	10.0.26100.2894	Yes
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)	KB5049984	Security Update	10.0.25398.1369	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5050009	Security Update	10.0.26100.2894	Yes
Windows 11 Version 24H2 for x64-based Systems	KB5050009	Security Update	10.0.26100.2894	Yes
Windows Server 2025	KB5050009	Security Update	10.0.26100.2894	Yes
Windows 10 for 32-bit Systems	KB5050013	Security Update	10.0.10240.20890	Yes
Windows 10 for x64-based Systems	KB5050013	Security Update	10.0.10240.20890	Yes
Windows 10 Version 1607 for 32-bit Systems	KB5049993	Security Update	10.0.14393.7699	Yes
Windows 10 Version 1607 for x64-based Systems	KB5049993	Security Update	10.0.14393.7699	Yes
Windows Server 2016	KB5049993	Security Update	10.0.14393.7699	Yes
Windows Server 2016 (Server Core installation)	KB5049993	Security Update	10.0.14393.7699	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows 11 Version 22H2 for ARM64-based Systems	KB5050021	Security Update	10.0.22621.4751	Yes
Windows 11 Version 22H2 for x64-based Systems	KB5050021	Security Update	10.0.22621.4751	Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows Server 2008 for 32-bit Systems Service Pack 2	KB5050063 KB5050061	Monthly Rollup Security Only	6.0.6003.23070 6.0.6003.23070	Yes Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	KB5050063 KB5050061	Monthly Rollup Security Only	6.0.6003.23070 6.0.6003.23070	Yes Yes
Windows Server 2008 for x64-based Systems Service Pack 2	KB5050063 KB5050061	Monthly Rollup Security Only	6.0.6003.23070 6.0.6003.23070	Yes Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	KB5050063 KB5050061	Monthly Rollup Security Only	6.0.6003.23070 6.0.6003.23070	Yes Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	KB5050049 KB5050006	Monthly Rollup Security Only	6.1.7601.27520 6.1.7601.27520	Yes Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	KB5050049 KB5050006	Monthly Rollup Security Only	6.1.7601.27520 6.1.7601.27520	Yes Yes
Windows Server 2012	KB5050004	Monthly Rollup	6.2.9200.25273	Yes
Windows Server 2012 (Server Core installation)	KB5050004	Monthly Rollup	6.2.9200.25273	Yes
Windows Server 2012 R2	KB5050048	Monthly Rollup	6.3.9600.22371	Yes
Windows Server 2012 R2 (Server Core installation)	KB5050048	Monthly Rollup	6.3.9600.22371	Yes

Security updates (14)

KB5050008 (Security Update)
KB5049983 (Security Update)
KB5049981 (Security Update)
KB5050021 (Security Update)
KB5050009 (Security Update)
KB5049984 (Security Update)
KB5050013 (Security Update)
KB5049993 (Security Update)
KB5050063 (Monthly Rollup)
KB5050061 (Security Only)
KB5050049 (Monthly Rollup)
KB5050006 (Security Only)
KB5050004 (Monthly Rollup)
KB5050048 (Monthly Rollup)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 7.5 (HIGH)
NVD weakness: CWE-126
Published to NVD: 14 January 2025
NVD last modified: 27 January 2025

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1507 (x64)	before 10.0.10240.20890
windows 10 1507 (x86)	before 10.0.10240.20890
windows 10 1607 (x64)	before 10.0.14393.7699
windows 10 1607 (x86)	before 10.0.14393.7699
windows 10 1809 (x64)	before 10.0.17763.6775
windows 10 1809 (x86)	before 10.0.17763.6775
windows 10 21h2	before 10.0.19044.5371
windows 10 22h2	before 10.0.19045.5371
windows 11 22h2	before 10.0.22621.4751
windows 11 23h2	before 10.0.22631.4751
windows 11 24h2	before 10.0.26100.2894
windows server 2008	all listed versions
windows server 2008 r2 (x64)	all listed versions
windows server 2012	all listed versions
windows server 2012 r2	all listed versions
windows server 2016	before 10.0.14393.7699
windows server 2019	before 10.0.17763.6775
windows server 2022	before 10.0.20348.3091
windows server 2022 23h2	before 10.0.25398.1369
windows server 2025 (x64)	before 10.0.26100.2894

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21277 (Patch, Vendor Advisory)

Acknowledgments

Azure Yang with Kunlun Lab

Revision history

Version	Date	Description
1.0	14 January 2025	Information published.