EUVD-2026-56773
GHSA-c494-m2fq-59mx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable QUIC endpoint requires no authentication or user interaction; UAF leaks heap memory (C:H) with no confirmed write primitive or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of any .NET 8.0, 9.0, or 10.0 application or Visual Studio 2022/2026 component that exposes a QUIC or HTTP/3 endpoint reachable from an untrusted network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a high-severity, remotely exploitable information disclosure requiring no authentication and no user interaction - a combination that makes it exploitable against any internet-facing QUIC or HTTP/3 endpoint running an affected .NET version. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends a crafted sequence of QUIC protocol packets to a vulnerable .NET or Visual Studio-based service endpoint accessible over the network. The malformed packet sequence triggers the use-after-free condition in the MsQuic connection or stream handling code, causing the runtime to dereference freed heap memory and return its contents in a protocol response or error path visible to the attacker. … |
| Remediation | The primary remediation is to upgrade to Microsoft's patched releases: .NET 8.0.30, .NET 9.0.19, or .NET 10.0.11 for runtime consumers, and Visual Studio 2022 17.14.38 or Visual Studio 2026 18.8.3 for IDE users, as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all production systems running .NET 8.0, 9.0, or 10.0, and identify which services have QUIC or HTTP/3 enabled and are accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attacker
.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today