Vulnerability · CVE-2026-105016

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Published Oct 13, 2026 · catalog updated Oct 16, 2026 · Microsoft Windows

Check if you run it

No confirmed exploitation is on record for CVE-2026-105016. EPSS is 0.99%. Act only if a listed version of Microsoft Windows is installed.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: Critical9.8
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.99%
Remediation: Advisory link
Affected products: microsoft .NET 10.0 installed on Windows · microsoft .NET 11.0 installed on Windows · microsoft .NET 8.0 installed on Windows · microsoft .NET 9.0 installed on Windows · microsoft Windows 11 Version 24H2 for ARM64-based Systems · microsoft Windows 11 Version 25H2 for ARM64-based Systems

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

microsoft .NET 10.0 installed on Windowsversion unspecified
microsoft .NET 11.0 installed on Windowsversion unspecified
microsoft .NET 8.0 installed on Windowsversion unspecified
microsoft .NET 9.0 installed on Windowsversion unspecified
microsoft Windows 11 Version 24H2 for ARM64-based Systemsversion unspecified
microsoft Windows 11 Version 25H2 for ARM64-based Systemsversion unspecified
microsoft Windows 11 Version 26H1 for ARM64-based Systemsversion unspecified
microsoft Windows 11 Version 26H2 for ARM64-based Systemsversion unspecified
microsoft Windows 11 Version 26H2 for x64-based Systemsversion unspecified
microsoft Windows 11 version 26H1 for x64-based Systemsversion unspecified
microsoft Windows Server 2025version unspecified
microsoft Windows Server 2025 (Server Core installation)version unspecified
nuget microsoft.native.quic.msquic.schannelversion unspecified
vendor Microsoft .NET 10.0version unspecified
vendor Microsoft .NET 11.0version unspecified
vendor Microsoft .NET 8.0version unspecified
vendor Microsoft .NET 9.0version unspecified
vendor Microsoft Microsoft Visual Studio 2022 version 17.14version unspecified
vendor Microsoft Microsoft Visual Studio 2026 version 18.10version unspecified
vendor Microsoft Windows 11 Version 23H2version unspecified
vendor Microsoft Windows 11 version 23H2version unspecified

How to fix CVE-2026-105016

Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-105016. EPSS is 0.99%. Act only if a listed version of Microsoft Windows is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-122: Heap-based Buffer Overflow. EPSS 0.99%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Windows security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
Oct 14, 2026 · CIRCL Vulnerability Lookup
Updated
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Oct 16, 2026 · NIST NVD
Updated
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Sources

CIRCL Vulnerability LookupVulnerability recordCVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
vulnerability.circl.lu
CVE.orgVulnerability recordCVE-2026-105016
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-105016
30-day exploitation probability 1.0%
first.org
GitLab Advisory DatabasePackage advisoryCVE-2026-105016
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
advisories.gitlab.com
Microsoft Security Update GuideVendor advisoryCVE-2026-105016
Windows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows Server 2025
msrc.microsoft.com
NCSC NetherlandsGovernment advisoryCVE-2026-105016
Microsoft heeft 1159 kwetsbaarheden verholpen in Windows. Het voert te ver om iedere kwetsbaarheid te benoemen. De 53 ernstigste kwetsbaarheden, met een CVSS score van 9 en hoger zijn weergegeven in onderstaande lijst en geven een kwaadwillende de mogelijkheid om zich voor te doe
advisories.ncsc.nl
NIST NVDVulnerability recordCVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
nvd.nist.gov

References

Microsoft QUIC Remote Code Execution Vulnerability · msrc.microsoft.com

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

31/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity15/15
Public exploit0/10
Internet exposure10/10
Product prevalence5/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS probability
0.99% · p61.74%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Advisory link
A patch or advisory reference is linked. Open the original publisher for availability by product version.

Stacks

Microsoft NuGet Windows Windows 11 Windows Server 2022 Windows Server 2025

Weakness

CWE-122
Heap-based Buffer Overflow
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.