Microsoft QUIC EUVD-2026-100390

Exploitation requires the target to be running Microsoft QUIC (MsQuic) with QUIC/HTTP3 or SMB-over-QUIC actually enabled and network-reachable - this is not a universal default across all Windows roles, which materially narrows the exposed attack surface. The CVSS AC:H further indicates a non-deterministic prerequisite (a timing/race window or a specific transient state produced by the insecure default variable initialization) that the attacker cannot directly control, limiting reliability. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the dependence on an enabled QUIC listener plus the race condition are the key limiting factors for defenders. Confirm the precise affected feature and configuration via the MSRC advisory.

This is a moderate-severity (CVSS 7.5) network-reachable issue whose real-world priority is tempered by several signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) shows an unauthenticated, remotely reachable flaw, but the HIGH attack complexity (AC:H) means exploitation depends on conditions outside the attacker's control (likely a timing/race window or a specific non-default state arising from the insecure default variable initialization, CWE-453). Impact is skewed toward availability (A:H) with only limited integrity impact (I:L) and NO confidentiality impact (C:N), so despite the 'Authentication Bypass' tag this behaves as a security-feature-bypass/DoS-class issue rather than a data-disclosure or full-compromise bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation at time of analysis. Net: real but not an emergency - patch on a normal cadence for QUIC/HTTP3-exposed Windows hosts; the AC:H and availability-only impact argue against treating it as a drop-everything item. Note a tension to verify: the 'Authentication Bypass' tag conflicts with C:N/I:L (a true auth bypass would usually carry confidentiality or higher integrity impact) - treat the tag with caution and rely on the MSRC advisory for the precise security feature affected.

A remote, unauthenticated attacker repeatedly connects to a Windows host exposing QUIC/HTTP3 (or SMB over QUIC) and exploits a security feature that is left in an insecure state due to default variable initialization. Because attack complexity is high, the attacker must win a specific timing or state condition to bypass the control, most plausibly degrading or disrupting the service (A:H). No public exploit code was identified at time of analysis.