What is the CVSS score of CVE-2026-62898?

CVE-2026-62898 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.1%.

Which versions of Microsoft QUIC are affected by CVE-2026-62898?

Microsoft's MsQuic protocol (embedded in .NET 8.0, 9.0, 10.0 and Visual Studio 2022, 2026) contains a high-severity vulnerability enabling unauthenticated remote attackers to expose sensitive data…. A patch is available.

Is there a public PoC exploit available for CVE-2026-62898?

Yes, a public proof-of-concept exploit is available for CVE-2026-62898. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2026-62898?

Within 24 hours, inventory all production systems running .NET 8.0, 9.0, or 10.0, and identify which services have QUIC or HTTP/3 enabled and are accessible from untrusted networks. Within 7 days, apply vendor-released security patches to all affected .NET versions and upgrade Visual Studio 2022 and 2026 to patched releases, prioritizing internet-facing services. Within 30 days, verify patch deployment across all development and production environments using host scanning tools, complete patching of any remaining systems, and review network monitoring data for exploitation attempts.

Microsoft QUIC CVE-2026-62898

EUVD-2026-56773 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-c494-m2fq-59mx

Denial Of Service Use After Free Memory Corruption Microsoft Visual Studio 2022 Net Visual Studio 2026

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable QUIC endpoint requires no authentication or user interaction; UAF leaks heap memory (C:H) with no confirmed write primitive or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:59 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.

Technical ContextAI

Microsoft QUIC (MsQuic) is Microsoft's open-source implementation of the IETF QUIC transport protocol (RFC 9000), a UDP-based, multiplexed, and encrypted transport stack used to power HTTP/3 and other low-latency network applications. MsQuic is embedded directly into the .NET 8.0, 9.0, and 10.0 runtimes as well as Microsoft Visual Studio 2022 and 2026, making it a shared transitive dependency across a large surface area of Microsoft-ecosystem applications. The root cause is CWE-416 (Use After Free): the implementation continues to reference a memory region after it has been deallocated, a class of flaw that typically manifests during connection lifecycle events such as stream teardown, packet reassembly, or timeout handling in a protocol state machine. In this instance, the freed memory region is readable by a crafted remote peer rather than writable, which constrains the impact to confidentiality (C:H) without an integrity or code-execution primitive - consistent with the CVSS I:N/A:N scoring. The affected CPE encompasses multiple .NET target framework monikers and the Visual Studio IDE toolchain.

RemediationAI

The primary remediation is to upgrade to Microsoft's patched releases: .NET 8.0.30, .NET 9.0.19, or .NET 10.0.11 for runtime consumers, and Visual Studio 2022 17.14.38 or Visual Studio 2026 18.8.3 for IDE users, as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898. For environments where immediate patching is not feasible, disabling HTTP/3 and QUIC support in .NET applications is the most targeted compensating control - this can be achieved by setting the environment variable DOTNET_SYSTEM_NET_HTTP_SOCKETSHTTPHANDLER_HTTP3SUPPORT=false or by configuring Kestrel/HttpClient to negotiate HTTP/1.1 or HTTP/2 only; the trade-off is loss of HTTP/3 performance benefits and potential client compatibility regression. As a network-layer control, blocking inbound UDP traffic on QUIC ports (typically UDP/443) via firewall or load-balancer ACLs removes the attack surface entirely but will also disable any QUIC-dependent functionality for end users. No patch version other than those listed above should be assumed safe - affected version ranges are sourced from ENISA EUVD-2026-56773 and should be verified against the live MSRC advisory.