CVE-2025-21285: Microsoft Message Queuing NULL pointer dereference denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated, low-complexity denial of service across a wide range of Windows versions, with very high EPSS despite no KEV listing.

What it is

Microsoft Message Queuing (MSMQ) on Windows client and server versions contains a NULL pointer dereference that lets a remote, unauthenticated attacker crash the service. The record gives no root-cause detail beyond the CWE, but the network vector and high availability impact make it a straightforward denial-of-service risk for any host exposing MSMQ.

Impact

An attacker can cause a denial of service against the MSMQ service, disrupting message queuing and any applications that depend on it. There is no confidentiality or integrity impact; the effect is availability loss.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so any host with MSMQ reachable on the network is exposed. The record does not state which port or interface is used.

Exploitation

Not listed in CISA KEV and no public exploit or PoC is referenced; the only reference is the Microsoft patch advisory. EPSS is 0.55686 (99th percentile), indicating a high predicted likelihood of exploitation activity despite the absence of confirmed in-the-wild use.

What to do

• Apply the Microsoft security update for CVE-2025-21285 on all affected Windows client and server versions.
• If MSMQ is not required, disable or uninstall the Message Queuing feature.
• Restrict network access to MSMQ endpoints with host and perimeter firewalls to trusted hosts only.
• Monitor the MSMQ service for unexpected restarts or crashes and investigate repeated failures.

Detection

• Alert on MSMQ service crashes or unexpected restarts in Windows event logs.
• Monitor for repeated connection attempts or malformed traffic to MSMQ listener ports.
• Baseline normal MSMQ traffic and flag anomalies from untrusted network segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.