Heap-based Buffer Overflow in Microsoft QUIC Affects Network Security
CVE-2026-105016

9.8CRITICAL

Key Information:

Vendor

Microsoft
Status
.net 10.0
.net 11.0
.net 8.0
.net 9.0
Vendor
CVE Published:
13 October 2026

What is CVE-2026-105016?

A heap-based buffer overflow vulnerability in Microsoft QUIC allows unauthorized attackers to execute arbitrary code remotely. This flaw could potentially enable adversaries to exploit the affected system over a network, posing significant risks to data integrity and confidentiality. It is essential for users of Microsoft QUIC to apply the necessary patches to mitigate these security risks.

Affected Version(s)

.NET 10.0 10.0.0 < 10.0.14

.NET 11.0 11.0.0 < 11.0.0-rc.2.26504.105

.NET 8.0 8.0.0 < 8.0.32

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.