MsQuic CVE-2026-105794

Exploitation requires three concrete conditions drawn from the description: (1) the target must be a MsQuic CLIENT (not server) initiating QUIC connections; (2) that client must be built against the OpenSSL or QuicTLS TLS backend - the Schannel backend is explicitly NOT affected, so default Windows/Schannel deployments are out of scope; and (3) the attacker must already occupy an on-path/man-in-the-middle position to intercept the connection and inject a mismatched certificate (reflected by AT:P in the CVSS 4.0 vector). The core defect is that the client does not verify the server certificate matches the intended target hostname (CWE-295). Limiting factors for defenders: the on-path prerequisite rules out off-path/remote-only attackers, the vulnerability is confined to the OpenSSL/QuicTLS backend, and it affects only versions prior to 2.4.20, 2.5.11, and 2.6.1. No user interaction or authentication is required once the attacker is on-path.

This is a genuine high-priority issue, though its exploitability is gated by a positional requirement rather than being trivially remote. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 9.1 because it couples unauthenticated network reach with high confidentiality and integrity impact (VC:H/VI:H), but the AT:P metric is doing critical work here: the 'P' (Attack Requirements: Present) reflects that the attacker must already hold an on-path/man-in-the-middle position, matching the description's 'on-path attacker' wording. So despite the network attack vector, this is NOT internet-wide remotely-triggerable code execution - it requires the attacker to intercept the client's traffic first. Signal cross-reference: there is no EPSS score, no CISA KEV listing, and no public exploit identified in the provided data, so active-exploitation pressure appears low. The flaw is further scoped to MsQuic clients built on the OpenSSL or QuicTLS backend; the Schannel backend is explicitly unaffected, which meaningfully narrows the real-world exposed population (notably excluding default Windows Schannel deployments). Net: a legitimately severe TLS trust failure (CWE-295) that defenders should patch, but the on-path prerequisite and backend scoping make it a targeted-interception risk rather than a mass-exploitation emergency.

An attacker positioned on the network path (e.g., rogue Wi-Fi access point, compromised router, or ARP/DNS spoofing on a shared segment) intercepts an outbound QUIC connection from a MsQuic client compiled against the OpenSSL or QuicTLS backend. The attacker presents a server certificate that does not match the intended target hostname; because the client fails to perform hostname verification, the handshake succeeds and the attacker fully impersonates the server, decrypting and modifying application traffic. No public exploit code was identified in the provided data, but the technique relies only on standard MITM tooling plus any attacker-held valid certificate.