What is the CVSS score of CVE-2026-32179?

CVE-2026-32179 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-32179?

Microsoft QUIC library versions prior to the patched commit contain a critical integer underflow vulnerability in ACK frame parsing that allows unauthenticated remote attackers to achieve privilege…. A patch is available.

How to fix or mitigate CVE-2026-32179?

Within 24 hours: Identify all applications and services using Microsoft QUIC NuGet packages (both OpenSSL and SChannel variants) via dependency scanning; notify development and infrastructure teams. Within 7 days: Update all Microsoft QUIC NuGet packages to versions containing commit 1e6e999b or later; validate updates in staging environments. Within 30 days: Complete deployment of patched versions to all production systems, document patch application in change management systems, and verify no vulnerable package versions remain in artifact repositories.

Microsoft CVE-2026-32179

CRITICAL

Integer Underflow (CWE-191)

2026-04-16 https://github.com/microsoft/msquic

GHSA-gvvw-8j96-8g5r

Authentication Bypass Integer Overflow Microsoft

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 01:20 vuln.today

Analysis Generated

Apr 16, 2026 - 01:15 vuln.today

Patch released

Apr 16, 2026 - 01:15 nvd

Patch available

CVE Published

Apr 16, 2026 - 01:04 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32179

AnalysisAI

Integer underflow in Microsoft QUIC's ACK frame parser enables remote unauthenticated privilege escalation. The vulnerability (CWE-191: integer wrap-around) affects Microsoft's native QUIC library implementations (both OpenSSL and SChannel variants) distributed via NuGet packages. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and vendor-confirmed patch available (commit 1e6e999b), this represents a critical network-exposed flaw in QUIC protocol implementations. No active exploitation confirmed (not in CISA KEV) and public exploit code status unknown at time of analysis, but the straightforward attack vector (network-accessible protocol parsing) and authentication bypass capability warrant immediate patching priority for systems using Microsoft QUIC libraries.

Technical ContextAI

QUIC (Quick UDP Internet Connections) is a modern transport protocol that forms the foundation of HTTP/3, designed to replace TCP+TLS with encrypted, multiplexed connections over UDP. Microsoft QUIC (msquic) is Microsoft's implementation of the IETF QUIC standard. The vulnerability resides in ACK (acknowledgment) frame parsing logic - ACK frames are core QUIC protocol elements used to confirm packet delivery. CWE-191 (Integer Underflow/Wrap-around) occurs when arithmetic operations on unsigned integers cause values to wrap below zero, potentially leading to buffer size miscalculations, memory corruption, or security checks being bypassed. In this case, improper input validation during ACK frame decoding allows a crafted frame to trigger an integer underflow, which the vendor confirms can lead to privilege escalation. The affected CPE strings identify NuGet packages for both OpenSSL-based and Windows SChannel-based TLS variants of the library, indicating the flaw exists in shared parsing code independent of the cryptographic backend.

RemediationAI

Apply vendor-released patch immediately by updating to msquic versions containing commit 1e6e999b199430effeefee3d85baa0c9dd35ad5e or later. For NuGet package consumers, update microsoft.native.quic.msquic.openssl and microsoft.native.quic.msquic.schannel packages to patched versions per https://github.com/microsoft/msquic/security/advisories/GHSA-gvvw-8j96-8g5r. Specific fixed version numbers should be obtained from the GitHub advisory or NuGet package manager updates. If immediate patching is not feasible, implement network-level compensating controls: restrict QUIC listener exposure using firewall rules to trusted networks only (blocks AV:N attack vector but breaks internet-facing QUIC services - acceptable trade-off only for internal-only applications); disable QUIC protocol support and fall back to TCP/TLS if application architecture permits (eliminates attack surface but loses QUIC performance benefits and breaks HTTP/3). Note these workarounds significantly impact functionality and should be temporary measures only. Consult official Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32179 for version-specific remediation instructions and compatibility notes.