GHSA-92f5-vc22-8j33

Microsoft QUIC: Remote Code Execution Vulnerability

En bref

Publiée
Mise à jour
CVE
CVE-2026-62815
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Description

# Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. # Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. ## Patches - Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b) # Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Paquets affectés

PaquetVersions
NuGet · Microsoft.Native.Quic.MsQuic.OpenSSLintroduced 2.5.3, fixed 2.5.10
NuGet · Microsoft.Native.Quic.MsQuic.Schannelintroduced 2.5.3, fixed 2.5.10
NuGet · Microsoft.Native.Quic.MsQuic.OpenSSLintroduced 0, fixed 2.4.19
NuGet · Microsoft.Native.Quic.MsQuic.Schannelintroduced 0, fixed 2.4.19

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database