Summary
Microsoft QUIC: Remote Code Execution Vulnerability
Advisory details
Summary
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Details
New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.
Patches
- Guard path promotion e0f55b5
Impact
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
References
- https://github.com/advisories/GHSA-92f5-vc22-8j33
- https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33
- https://nvd.nist.gov/vuln/detail/CVE-2026-62815
- https://github.com/microsoft/msquic/pull/6217
- https://github.com/microsoft/msquic/pull/6219
- https://github.com/microsoft/msquic/pull/6220
- https://github.com/microsoft/msquic/commit/583e7d5b509bb0bfa3518482d98879b6eda41ad0
- https://github.com/microsoft/msquic/commit/9ff06b71fd4b4d5258361598ada5b24cbc1beb20
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-85790
Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability
- HIGHGHSA-wq5f-xc86-pv6w
sharp : Vulnerability in librsvg dependency CVE-2026-96889
- MEDIUMGHSA-mwm8-39rw-8826
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
- MEDIUMCVE-2026-55406
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
- HIGHGHSA-6v7p-g79w-8964
MessagePack for Python (the `msgpack` package) has an out-of-bounds read in versions up to and including 1.2.0. If an `Unpacker` is reused after it has raised and caught an error, it can read out of bounds and crash the process with a segmentation fault. Code that streams untrusted MessagePack through a single long-lived `Unpacker` can therefore be crashed on demand, a denial-of-service risk.
- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)