CVE-2026-32179 — Vulnerability in...

CRITICAL

MsQuic has a Remote Elevation of Privilege Vulnerability

Published April 16, 2026Updated May 8, 2026Source: osv

Summary

### Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. ### Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. #### Patches - Fix underflow in ACK frame parsing - 1e6e999b ### Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.

Advisory Timeline

First published April 16, 2026 (179 days ago).
Last revised May 8, 2026 — 23 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update Microsoft.Native.Quic.MsQuic.Schannel to 2.5.7 or later

dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.5.7

NuGet

Update Microsoft.Native.Quic.MsQuic.Schannel to 2.4.18 or later

dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.4.18

NuGet

Update Microsoft.Native.Quic.MsQuic.OpenSSL to 2.4.18 or later

dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.4.18

NuGet

Update Microsoft.Native.Quic.MsQuic.OpenSSL to 2.5.7 or later

dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.5.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: nuget (2).

Package	Ecosystem	Affected	Fixed In
Microsoft.Native.Quic.MsQuic.Schannel	nuget	All versions	2.5.7
Microsoft.Native.Quic.MsQuic.Schannel	nuget	1.8.0	2.4.18
Microsoft.Native.Quic.MsQuic.OpenSSL	nuget	1.8.0	2.4.18
Microsoft.Native.Quic.MsQuic.OpenSSL	nuget	All versions	2.5.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-191
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-32179?: MsQuic has a Remote Elevation of Privilege Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-32179?: CVE-2026-32179 affects Microsoft.Native.Quic.MsQuic.Schannel and Microsoft.Native.Quic.MsQuic.OpenSSL. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-32179 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-gvvw-8j96-8g5r

Related CVEs

CVE-2026-62815
CRITICAL
Microsoft QUIC: Remote Code Execution Vulnerability
CVE-2026-59865
CRITICAL
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
CVE-2026-75513
CRITICAL
Marten's LINQ provider has SQL injection via unescaped string literals
CVE-2026-105794
CRITICAL
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
GHSA-2x7m-gf85-3745
HIGH
Remote Denial of Service Vulnerability in Microsoft QUIC
CVE-2023-36435
HIGH
MsQuic Remote Denial of Service Vulnerability
CVE-2023-38171
HIGH
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies