GHSA-92f5-vc22-8j33
Microsoft QUIC: Remote Code Execution Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2026-62815
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description
# Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. # Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. ## Patches - Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b) # Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 2.5.3, fixed 2.5.10 |
| NuGet · Microsoft.Native.Quic.MsQuic.Schannel | introduced 2.5.3, fixed 2.5.10 |
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 0, fixed 2.4.19 |
| NuGet · Microsoft.Native.Quic.MsQuic.Schannel | introduced 0, fixed 2.4.19 |
References
- https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-62815 ADVISORY
- https://github.com/microsoft/msquic/pull/6217 WEB
- https://github.com/microsoft/msquic/pull/6219 WEB
- https://github.com/microsoft/msquic/pull/6220 WEB
- https://github.com/microsoft/msquic/commit/583e7d5b509bb0bfa3518482d98879b6eda41ad0 WEB
- https://github.com/microsoft/msquic/commit/9ff06b71fd4b4d5258361598ada5b24cbc1beb20 WEB
- https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b WEB
- https://github.com/microsoft/msquic PACKAGE
- https://github.com/microsoft/msquic/releases/tag/v2.4.19 WEB
- https://github.com/microsoft/msquic/releases/tag/v2.5.10 WEB
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |