Microsoft QUIC (MsQuic) CVE-2026-85790

Exploitation requires the target to be running Microsoft QUIC - specifically a .NET application or Windows component using the MsQuic Schannel native binary (Microsoft.Native.Quic.MsQuic.Schannel versions >=1.9.0, <=2.6.1), i.e. an HTTP/3 / QUIC server or client endpoint that is network-reachable. Self-contained .NET apps built against affected versions remain vulnerable until recompiled and redeployed. Limiting factors: the CVSS AC:H reflects a use-after-free race condition that the attacker must win, so exploitation is non-deterministic; the host must actually have a QUIC/HTTP-3 listener or connection active (not merely have Windows installed); impact is confined to confidentiality (memory disclosure), with no integrity or availability effect. No authentication and no user interaction are required (PR:N/UI:N).

Signals are consistent and point to a genuine-but-moderate issue, not a fire-drill. The vendor-confirmed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9, Moderate) shows a network-reachable, unauthenticated flaw requiring no user interaction, but with high attack complexity - characteristic of a use-after-free race that an attacker cannot reliably win on demand. Impact is confidentiality-only (C:H, I:N, A:N): information disclosure, not code execution or service outage. CISA SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. No KEV listing and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from this data. Net assessment: patch in normal cycle rather than emergency. Note the input Tags include 'Denial Of Service' and 'Memory Corruption', which conflict with the A:N/I:N vector - the authoritative impact is information disclosure only; verify tag accuracy against the MSRC/GHSA advisories.

An attacker who can reach a network service built on Microsoft QUIC (MsQuic / .NET HTTP-3 via Microsoft.Native.Quic.MsQuic.Schannel) sends specially sequenced QUIC traffic that triggers a use-after-free in the MsQuic connection handling. Winning the resulting race causes the service to read and return freed heap memory, potentially leaking sensitive in-process data over the network. No public exploit code was identified, and the high attack complexity (race condition) makes reliable exploitation difficult.