Open-source package vulnerability · NuGet

CVE-2026-32179: MsQuic has a Remote Elevation of Privilege Vulnerability

criticalCVSS 3.1 9.8GHSA-gvvw-8j96-8g5r

Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. Patches - Fix underflow in ACK frame parsing - 1e6e999b Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.

Published Apr 16, 2026 · Updated May 8, 2026

Affected packages

Microsoft.Native.Quic.MsQuic.OpenSSL

Ecosystem: NuGet
Affected: >= 2.5.0-ci.532574, < 2.5.7
Fixed in: 2.5.7
Check: dotnet list package --include-transitive

Microsoft.Native.Quic.MsQuic.Schannel

Ecosystem: NuGet
Affected: >= 2.5.0-ci.532574, < 2.5.7
Fixed in: 2.5.7
Check: dotnet list package --include-transitive

Microsoft.Native.Quic.MsQuic.Schannel

Ecosystem: NuGet
Affected: < 2.4.18
Fixed in: 2.4.18
Check: dotnet list package --include-transitive

Microsoft.Native.Quic.MsQuic.OpenSSL

Ecosystem: NuGet
Affected: < 2.4.18
Fixed in: 2.4.18
Check: dotnet list package --include-transitive

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More NuGet vulnerabilities

All NuGet entries