CVE-2026-62815: Microsoft QUIC: Remote Code Execution Vulnerability
Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. Patches - Guard path promotion e0f55b5 Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
Published Sep 8, 2026
Affected packages
Microsoft.Native.Quic.MsQuic.OpenSSL
- Ecosystem
- NuGet
- Affected
- >= 2.5.3, < 2.5.10
- Fixed in
- 2.5.10
- Check
dotnet list package --include-transitive
Microsoft.Native.Quic.MsQuic.Schannel
- Ecosystem
- NuGet
- Affected
- >= 2.5.3, < 2.5.10
- Fixed in
- 2.5.10
- Check
dotnet list package --include-transitive
Microsoft.Native.Quic.MsQuic.OpenSSL
- Ecosystem
- NuGet
- Affected
- < 2.4.19
- Fixed in
- 2.4.19
- Check
dotnet list package --include-transitive
Microsoft.Native.Quic.MsQuic.Schannel
- Ecosystem
- NuGet
- Affected
- < 2.4.19
- Fixed in
- 2.4.19
- Check
dotnet list package --include-transitive
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Details
New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.
Patches
- Guard path promotion e0f55b5
Impact
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
References
- https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33
- https://nvd.nist.gov/vuln/detail/CVE-2026-62815
- https://github.com/microsoft/msquic/pull/6217
- https://github.com/microsoft/msquic/pull/6219
- https://github.com/microsoft/msquic/pull/6220
- https://github.com/microsoft/msquic/commit/583e7d5b509bb0bfa3518482d98879b6eda41ad0
- https://github.com/microsoft/msquic/commit/9ff06b71fd4b4d5258361598ada5b24cbc1beb20
- https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b
- https://github.com/microsoft/msquic/releases/tag/v2.4.19
- https://github.com/microsoft/msquic/releases/tag/v2.5.10
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815
- https://github.com/advisories/GHSA-92f5-vc22-8j33
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More NuGet vulnerabilities
All NuGet entriesCVE-2026-105016
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
critical9.8Oct 13, 2026CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
critical9.1Oct 6, 2026CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability
critical9.8Apr 16, 2026