fkie_cve-2026-105016

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

GHSA-5gjq-3f94-rcf7 — Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Affected: NuGet: Microsoft.Native.Quic.MsQuic.Schannel

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/446

## CVSS Details

- **Version:** 3.1 - **Severity:** Critical - **Score:** 9.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

- **Weakness:** CWE-122 (Heap-based Buffer Overflow) ## Affected Platforms

- **Platforms:** Windows - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.Native.Quic.MsQuic.Schannel](https://www.nuget.org/packages/Microsoft.Native.Quic.MsQuic.Schannel) | >= 2.5.11-ci.156755675, <= 2.5.11-ci.156755675 | 2.5.11-ci.159417053

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?

If your application uses a package version listed in [affected packages](#affected-packages), it is exposed to the vulnerability.…

NCSC-2026-0423 — Kwetsbaarheden verholpen in Microsoft Windows

NCSC-2026-0423

Most recent entries from all

fkie_cve-2026-105016

GHSA-5gjq-3f94-rcf7 — Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

NCSC-2026-0423 — Kwetsbaarheden verholpen in Microsoft Windows