# CVE-2026-18798: OpenSSL QUIC double free in QRX object

Source: https://junglewise.ai/threats/cve-2026-18798-openssl-quic-double-free-in-qrx-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18798 · Severity: high · CVSS 7.5 · Published 2026-08-25

OpenSSL's QUIC (Quick UDP Internet Connections) implementation contains a double-free memory vulnerability in its packet handling logic. When a malformed network packet triggers channel creation to fail, the same memory object is freed twice, corrupting the heap and crashing the QUIC server process. This results in service unavailability for applications relying on OpenSSL's QUIC protocol support.

Technologies: [OpenSSL](https://junglewise.ai/threats/technologies/openssl). Vendors: [OpenSSL](https://junglewise.ai/threats/vendors/openssl).

## Quick answers

**Is CVE-2026-18798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18798 being exploited in the wild.

**How severe is CVE-2026-18798?** High severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** OpenSSL <UNKNOWN>.

**Is there a fix for CVE-2026-18798?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18798 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18798?** Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a double-free (CWE-415) in the port_default_packet_handler() function within OpenSSL's QUIC stack. When validating an initial QUIC packet, a QRX (QUIC record layer RX) object is created for validation. If validation succeeds but subsequent channel creation via port_bind_channel() fails—triggered by a malformed INITIAL packet with an invalid-length DCID (destination connection ID shorter than 8 bytes)—the QRX object is freed twice: once by port_bind_channel() on error and again by the default handler's error branch. Exploitation requires network-level access to send a non-RFC 9000 compliant QUIC INITIAL packet. The result is heap corruption and process termination (denial of service); remote code execution is considered highly improbable.

## Affected products

- OpenSSL OpenSSL <UNKNOWN>

## Timeline

- 2026-08-25: disclosed

## Related threats

- [OpenSSL AES-GCM-SIV heap out-of-bounds read in EVP_CipherInit_ex](https://junglewise.ai/threats/cve-2026-95692-issue-summary-setting-an-aes-gcm-siv-iv-shorter-than-the-expected)
- [OpenSSL use-after-free in QUIC CRYPTO frame handling](https://junglewise.ai/threats/cve-2026-95691-issue-summary-a-retransmitted-quic-crypto-frame-can-release)
- [OpenSSL AES-GCM-SIV authentication tag bypass in AAD processing](https://junglewise.ai/threats/cve-2026-88823-issue-summary-the-aes-gcm-siv-implementation-treats-a-zero-length)
- [OpenSSL QUIC uninitialized stack data leak in peer detection](https://junglewise.ai/threats/cve-2026-88822-issue-summary-quic-when-performing-automated-peer-detection-may)
- [OpenSSL infinite loop in CMS encryption with EC certificates](https://junglewise.ai/threats/cve-2026-107496-issue-summary-encrypting-a-cms-message-to-an-ec-certificate)