CVE-2026-62815 — Vulnerability in...

CRITICAL

Microsoft QUIC: Remote Code Execution Vulnerability

Published September 8, 2026Updated September 8, 2026Source: osv

Summary

# Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. # Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. ## Patches - Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b) # Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Advisory Timeline

First published September 8, 2026 (34 days ago).
Last revised September 8, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update Microsoft.Native.Quic.MsQuic.OpenSSL to 2.4.19 or later

dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.4.19

NuGet

Update Microsoft.Native.Quic.MsQuic.OpenSSL to 2.5.10 or later

dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.5.10

NuGet

Update Microsoft.Native.Quic.MsQuic.Schannel to 2.4.19 or later

dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.4.19

NuGet

Update Microsoft.Native.Quic.MsQuic.Schannel to 2.5.10 or later

dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.5.10

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: nuget (2).

Package	Ecosystem	Affected	Fixed In
Microsoft.Native.Quic.MsQuic.OpenSSL	nuget	1.8.0	2.4.19
Microsoft.Native.Quic.MsQuic.OpenSSL	nuget	All versions	2.5.10
Microsoft.Native.Quic.MsQuic.Schannel	nuget	1.8.0	2.4.19
Microsoft.Native.Quic.MsQuic.Schannel	nuget	All versions	2.5.10

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-416
Use After FreeMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-62815?: Microsoft QUIC: Remote Code Execution Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-62815?: CVE-2026-62815 affects Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-62815 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-92f5-vc22-8j33

Related CVEs

CVE-2026-32179
CRITICAL
MsQuic has a Remote Elevation of Privilege Vulnerability
CVE-2026-59865
CRITICAL
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
CVE-2026-75513
CRITICAL
Marten's LINQ provider has SQL injection via unescaped string literals
CVE-2026-105794
CRITICAL
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
GHSA-2x7m-gf85-3745
HIGH
Remote Denial of Service Vulnerability in Microsoft QUIC
CVE-2023-36435
HIGH
MsQuic Remote Denial of Service Vulnerability
CVE-2023-38171
HIGH
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies