Microsoft QUIC CVE-2026-100219

Exploitation requires that the target be reachable over a QUIC/UDP path AND be running a service built on the Microsoft QUIC (MsQuic) stack - for example an HTTP/3 (443/UDP) endpoint or an SMB-over-QUIC file server, or a QUIC client induced to connect to an attacker-controlled server. The primary limiting factor is that a QUIC listener must be exposed and processing attacker traffic; Windows hosts without an enabled/reachable QUIC-based service are not exploitable via this path. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required once a vulnerable QUIC endpoint is reachable; the realistic constraint is the heap/timing manipulation needed to weaponize the use-after-free into code execution rather than a mere crash.

All provided signals point to a top-tier priority on paper: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, unauthenticated, no-user-interaction use-after-free (CWE-416) in Microsoft QUIC with full C:H/I:H/A:H impact, yielding a 9.8 critical score. However, several key exploitation signals are MISSING from the provided data: there is no EPSS probability, no CISA KEV entry, and no POC indicator, so real-world exploitation likelihood cannot be quantified from the inputs - exploitation status is therefore 'no public exploit identified at time of analysis.' This is a genuine high-priority issue because Microsoft QUIC (MsQuic) underpins HTTP/3 and SMB-over-QUIC in the Windows ecosystem, but note a tension between the metadata and the description: the Tags list 'Denial Of Service' first, while the description and the C:H/I:H/A:H vector describe remote code execution - UAF bugs can yield both, but defenders should treat RCE as the operative worst case. One caveat on exploitability: the input rates AC:L, yet reliably turning a UAF into code execution over a network protocol typically requires heap grooming and winning a timing/allocation window, which argues the practical attack complexity is higher than AC:L implies - verify weaponization difficulty before assuming trivial mass exploitation.

A remote, unauthenticated attacker sends specially crafted QUIC traffic to a Windows host or service that uses the MsQuic stack (e.g., an HTTP/3 endpoint or SMB-over-QUIC listener), triggering a use-after-free in connection or stream handling. By controlling the freed object's reuse, the attacker corrupts memory to achieve arbitrary code execution in the context of the QUIC-handling service. No public exploit code is identified at time of analysis, and reliable exploitation would likely require heap manipulation to control the freed allocation.