CVE-2026-62898: Use After Free Information Disclosure in Microsoft QUIC
Vulnerability ID: CVE-2026-62898
CVSS Score: 7.5
Published: 2026-08-11
A critical use-after-free vulnerability in Microsoft QUIC allows unauthenticated remote attackers to disclose sensitive system memory over the network. The vulnerability is caused by a race condition during rapid connection termination and asynchronous packet retransmission.
TL;DR
Use-after-free in MSQuic leads to high-impact remote information disclosure of server memory.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-416
- Attack Vector: Network
- CVSS Score: 7.5 (High)
- EPSS Score: 0.00%
- Exploit Status: No weaponized exploit available
- KEV Status: Not listed in CISA KEV
Affected Systems
- .NET 10.0
- .NET 9.0
- .NET 8.0
- Microsoft Visual Studio 2022
- Microsoft Visual Studio 2026
-
.NET 10.0: >= 10.0.0, < 10.0.11 (Fixed in:
10.0.11) -
.NET 9.0: >= 9.0.0, < 9.0.19 (Fixed in:
9.0.19) -
.NET 8.0: >= 8.0.0, < 8.0.30 (Fixed in:
8.0.30) -
Microsoft Visual Studio 2022: >= 17.14.0, < 17.14.38 (Fixed in:
17.14.38) -
Microsoft Visual Studio 2026: >= 18.0, < 18.8.3 (Fixed in:
18.8.3)
Code Analysis
Commit: 6d9e1b3
[release/10.0] [QUIC] Update MsQuic to the latest 2.5 version (#130354)
Mitigation Strategies
- Apply security patches for .NET runtime and Visual Studio immediately.
- Disable HTTP/3 (QUIC) and fall back to HTTP/2 (TCP) if immediate patching is not possible.
Remediation Steps:
- Identify systems running vulnerable .NET runtime or Visual Studio versions.
- Deploy patched updates (10.0.11, 9.0.19, 8.0.30, etc.) across all development and production environments.
- Restart services hosting QUIC configurations to load the new msquic.dll module.
References
- Microsoft Security Response Center Advisory
- CVE-2026-62898 Authorization and Record
- Fix Commit in dotnet/runtime
Read the full report for CVE-2026-62898 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)