Executive brief
Microsoft QUIC is a network protocol implementation used to handle secure data transmission. A memory management flaw in this component allows an attacker on the network to remotely execute code without authentication. This could enable complete compromise of systems using the vulnerable QUIC library, leading to data theft, service disruption, or malware installation.
Technical details
A use-after-free vulnerability (CWE-416) exists in Microsoft QUIC that allows an unauthenticated network attacker to achieve remote code execution. The vulnerability occurs when memory is freed but subsequently accessed through a stale pointer, potentially allowing an attacker to control the reused memory location. Attack vector is network-based with low complexity, no authentication required, and no user interaction necessary. An attacker can craft malicious QUIC protocol packets to trigger the flaw and execute arbitrary code. Microsoft Native QUIC library versions before 2.4.19 are affected. Patch availability: no patched versions are listed in the advisory, though the version constraint suggests patches may be available beyond 2.4.19.
Affected products
- Microsoft Native QUIC (MsQuic) with OpenSSL < 2.4.19
Timeline
- 2026-08-11: disclosed