~ / search / GHSA-92f5-vc22-8j33

GHSA-92f5-vc22-8j33

Microsoft QUIC: Remote Code Execution Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-62815

Packages

EcosystemPackageAffectedFixed in
NuGet Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.3, < 2.5.10 2.5.10
NuGet Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.3, < 2.5.10 2.5.10
NuGet Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.19 2.4.19
NuGet Microsoft.Native.Quic.MsQuic.Schannel < 2.4.19 2.4.19

Details

As written in the advisory (Markdown source, shown as plain text).

# Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. # Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. ## Patches - Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b) # Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

References

External links from the advisory. They lead to third-party sites.