Executive brief
A security vulnerability exists in Microsoft QUIC, a networking protocol used by .NET applications to communicate over the internet. An unauthorized attacker could exploit this flaw to access sensitive information that should otherwise be protected. This could lead to the exposure of private data or internal system details, potentially damaging a company's reputation or compromising customer privacy.
Technical details
A use-after-free (CWE-416) vulnerability exists in the Microsoft QUIC implementation used by the .NET runtime on Windows. The flaw occurs when the software continues to use a pointer after the memory it points to has been freed, which can be triggered by a remote, unauthenticated attacker over the network. Successful exploitation allows for unauthorized information disclosure. The vulnerability affects .NET 8, 9, and 10 runtimes on Windows across all architectures. Microsoft has released patches in versions 8.0.30, 9.0.19, and 10.0.11; developers must update their SDKs/runtimes and redeploy self-contained applications.
Affected products
- Microsoft .NET Core App Runtime (win-arm64) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
- Microsoft .NET Core App Runtime (win-x64) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
- Microsoft .NET Core App Runtime (win-x86) 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10
Timeline
- 2026-08-11: disclosed: Advisory published by Microsoft and GitHub
- 2026-08-11: patched