Microsoft QUIC CVE-2026-105016

The target must expose a network service built on the Microsoft QUIC (msquic) library - i.e., a QUIC/HTTP-3 or SMB-over-QUIC endpoint reachable over UDP (typically port 443). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required beyond having the QUIC-based service enabled and internet- or network-reachable. The primary limiting factor is deployment surface: only hosts that have actually enabled a QUIC/HTTP-3 listener (not all Windows/.NET systems enable it by default) are exposed, and successful code execution - versus a crash - depends on defeating standard heap and control-flow mitigations.

All available CVSS signals point to a high-priority, remotely exploitable flaw: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact (base score 9.8), consistent with the CWE-122 heap-based buffer overflow in the description. However, the exploitation-likelihood signals are entirely absent from the provided intelligence: no EPSS probability, no CISA KEV listing, and no proof-of-concept were supplied, so there is no public exploit identified at time of analysis. The practical consequence is a classic 'high CVSS, unproven real-world exploitation' situation - the theoretical severity is maximal, but heap overflows in a modern, mitigation-hardened transport library (ASLR, CFG, heap hardening) often require non-trivial exploit development to achieve reliable RCE, which may explain the absence of a POC. Because the EPSS and KEV data are missing rather than confirmed-negative, their absence should not be read as 'low risk'; it should be treated as unknown and re-checked against vendor/CISA feeds. Net: patch promptly given the unauthenticated-network RCE profile and the ubiquity of the QUIC stack, but current evidence indicates no confirmed active exploitation.

A remote, unauthenticated attacker sends specially crafted QUIC/HTTP-3 packets to a network-facing service that uses the Microsoft QUIC (msquic) stack, triggering a heap-based buffer overflow during packet parsing. Successful memory corruption could lead to arbitrary code execution in the context of the handling process. No public proof-of-concept or exploit code was provided in the intelligence sources.