GHSA-gvvw-8j96-8g5r
MsQuic has a Remote Elevation of Privilege Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-32179
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
### Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. ### Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. #### Patches - Fix underflow in ACK frame parsing - 1e6e999b ### Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 2.5.0-ci.532574, fixed 2.5.7 |
| NuGet · Microsoft.Native.Quic.MsQuic.Schannel | introduced 2.5.0-ci.532574, fixed 2.5.7 |
| NuGet · Microsoft.Native.Quic.MsQuic.Schannel | introduced 0, fixed 2.4.18 |
| NuGet · Microsoft.Native.Quic.MsQuic.OpenSSL | introduced 0, fixed 2.4.18 |
Références
- https://github.com/microsoft/msquic/security/advisories/GHSA-gvvw-8j96-8g5r WEB
- https://github.com/microsoft/msquic/commit/1e6e999b199430effeefee3d85baa0c9dd35ad5e WEB
- https://github.com/microsoft/msquic PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |