What is the CVSS score of EUVD-2026-56392?

EUVD-2026-56392 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Microsoft QUIC are affected by EUVD-2026-56392?

Microsoft's MsQuic QUIC transport implementation contains a critical remote code execution vulnerability (CVE-2026-62815, CVSS 9.8) affecting Windows 11 and Windows Server 2022/2025 systems.. A patch is available.

How to fix or mitigate EUVD-2026-56392?

Within 24 hours, conduct an immediate asset inventory to identify all Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 systems potentially affected by CVE-2026-62815, prioritizing those with internet-facing or untrusted network exposure. Within 7 days, begin phased deployment of the vendor-released patch, starting with critical infrastructure (domain controllers, mail servers, cloud-facing systems) in a controlled staging environment to verify compatibility before production rollout. Within 30 days, complete patching across all affected systems organization-wide, validate successful deployment through patch verification scans, and document remediation status for compliance records.

Microsoft QUIC EUVD-2026-56392

| CVE-2026-62815 CRITICAL

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-2q33-cf8w-7q23

GHSA-92f5-vc22-8j33

Denial Of Service Use After Free Memory Corruption Microsoft Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.1 HIGH

Unauthenticated network-facing QUIC handler (AV:N/PR:N/UI:N) with full impact, but AC:H because reliable use-after-free RCE requires heap grooming and race timing versus a simple crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:15 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Technical ContextAI

QUIC is a UDP-based, encrypted transport protocol (RFC 9000) used as the foundation for HTTP/3 and increasingly for SMB over QUIC, and Microsoft ships its own implementation, MsQuic, integrated into the Windows networking stack (msquic.sys / associated user-mode libraries). The root cause is a use-after-free (CWE-416): the code continues to reference a heap object after it has been freed, typically during connection state teardown, stream lifecycle handling, or packet reassembly. An attacker who controls the timing or sequencing of QUIC packets can cause a dangling pointer to be dereferenced, potentially allowing controlled reallocation of the freed region and hijack of program flow. Because QUIC parsing happens early in the connection lifecycle over the network, the vulnerable code is reachable before any application-layer authentication.

RemediationAI

Apply the Microsoft security update that raises each affected build to at least the fixed version listed in the EUVD data (Vendor-released patch confirmed available): Windows 11 23H2 to 10.0.22631.7517, 24H2 to 10.0.26100.9168, 25H2 to 10.0.26200.9168, 26H1 to 10.0.28000.2704, Windows Server 2022 to 10.0.20348.5499, and Windows Server 2025 (incl. Server Core) to 10.0.26100.33296, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815. Where patching must be delayed, reduce exposure of the QUIC attack surface: block inbound UDP/443 (and any other QUIC listener ports) at the perimeter and host firewall for systems that do not need HTTP/3 or SMB over QUIC, and disable SMB over QUIC on servers where it is not required (Set-SmbServerConfiguration / SMB over QUIC settings) - noting these controls will break HTTP/3 and remote QUIC-based SMB access respectively. Disabling HTTP/3 in IIS/edge services forces clients to fall back to HTTP/2 over TCP with minimal functional loss for most workloads.