CVE-2026-62898: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVE-2026-62898 · Severity: high · CVSS 7.5 · Published 2026-08-11

A security vulnerability exists in Microsoft QUIC, a networking protocol used by .NET applications to communicate over the internet. An unauthorized attacker could exploit this flaw to access sensitive information that should otherwise be protected. This could lead to the exposure of private data or internal system details, potentially damaging a company's reputation or compromising customer privacy.

Technologies: Microsoft .Net, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft.NetCore.App.Runtime.win-arm64 (NuGet), Microsoft.NetCore.App.Runtime.win-x64 (NuGet), Microsoft.NetCore.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-62898 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62898 being exploited in the wild.
How severe is CVE-2026-62898?
High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?
Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.win-x64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.win-x86 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11.
Is there a fix for CVE-2026-62898?
Yes. Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62898 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-62898?
Check whether you run Microsoft .Net, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 10.0.11
  • Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 10.0.11
  • Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.11 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 10.0.11

Technical details

A use-after-free (CWE-416) vulnerability exists in the Microsoft QUIC implementation used by the .NET runtime on Windows. The flaw occurs when the software continues to use a pointer after the memory it points to has been freed, which can be triggered by a remote, unauthenticated attacker over the network. Successful exploitation allows for unauthorized information disclosure. The vulnerability affects .NET 8, 9, and 10 runtimes on Windows across all architectures. Microsoft has released patches in versions 8.0.30, 9.0.19, and 10.0.11; developers must update their SDKs/runtimes and redeploy self-contained applications.

Affected products

  • Microsoft .NET Core App Runtime (win-arm64) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
  • Microsoft .NET Core App Runtime (win-x64) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
  • Microsoft .NET Core App Runtime (win-x86) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10

Identifiers

  • CVE-2026-62898
  • GHSA-c494-m2fq-59mx

Timeline

  • 2026-08-11: disclosed: Advisory published by Microsoft and GitHub
  • 2026-08-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.