CVE-2026-105016
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
Published Oct 13, 2026 · updated Oct 14, 2026 · Microsoft .NET 10.0
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
Oct 14, 2026 · CIRCL Vulnerability Lookup
Updated
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Affected
- nuget microsoft.native.quic.msquic.schannelversion unspecified
- vendor Microsoft .NET 10.0version unspecified
- vendor Microsoft .NET 11.0version unspecified
- vendor Microsoft .NET 8.0version unspecified
- vendor Microsoft .NET 9.0version unspecified
- vendor Microsoft Microsoft Visual Studio 2022 version 17.14version unspecified
- vendor Microsoft Microsoft Visual Studio 2026 version 18.10version unspecified
- vendor Microsoft Windows 11 Version 23H2version unspecified
- vendor Microsoft Windows 11 version 23H2version unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
vulnerability.circl.lu - CVE.orgCVE-2026-105016
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-105016
30-day exploitation probability 1.0%
first.org - GitLab Advisory DatabaseCVE-2026-105016
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
advisories.gitlab.com