EUVD-2026-56392
GHSA-2q33-cf8w-7q23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Windows QUIC listener
-
DeliverySend crafted QUIC/UDP packet sequence
-
ExploitTrigger use-after-free in MsQuic
-
ExecutionGroom heap and reclaim freed object
-
PersistHijack control flow
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target host be running and reachable on a Microsoft QUIC listener - i.e., an unpatched Windows 11 (23H2-26H1) or Windows Server 2022/2025 system with a QUIC-based service enabled and exposed, such as HTTP/3 in IIS/edge services or SMB over QUIC (typically UDP/443). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against such a listener. The primary limiting factor is exposure: systems with no QUIC listener bound or with inbound UDP/443 blocked are not remotely reachable via this path, and reliable code execution (versus a crash) additionally requires the attacker to defeat Windows heap and memory-protection mitigations. |
| Impact | This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector is fully remote and unauthenticated with low attack complexity (AV:N/AC:L/PR:N/UI:N) and complete C/I/A impact, and the flaw sits in a network-facing OS transport component on widely deployed Windows platforms. Counterbalancing signals: there is no CISA KEV listing (not confirmed actively exploited) and no public exploit code identified at time of analysis, so exploitation is currently theoretical/pre-weaponization. EPSS was not provided in the input and cannot be cited. In practice, use-after-free bugs over a network protocol are non-trivial to turn into reliable RCE (heap grooming, ASLR/DEP bypass required), so real-world exploitation may lag the CVSS rating - but the memory-corruption class combined with an unauthenticated network vector and 'wormable-adjacent' transport exposure makes prompt patching warranted. The 'Denial Of Service' tag suggests the most immediately achievable impact (crashing the QUIC stack) even before reliable code execution is developed. |
| Exploit ScenarioDerived | An attacker sends a crafted sequence of QUIC/UDP packets to a Windows host exposing a QUIC listener (e.g., an HTTP/3 web server or SMB-over-QUIC file server), triggering the use-after-free during connection or stream state handling. With successful heap manipulation this yields code execution in the context of the vulnerable service without any credentials or user interaction; a less refined attempt still crashes the QUIC stack for denial of service. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
RemediationAI
Apply the Microsoft security update that raises each affected build to at least the fixed version listed in the EUVD data (Vendor-released patch confirmed available): Windows 11 23H2 to 10.0.22631.7517, 24H2 to 10.0.26100.9168, 25H2 to 10.0.26200.9168, 26H1 to 10.0.28000.2704, Windows Server 2022 to 10.0.20348.5499, and Windows Server 2025 (incl. Server Core) to 10.0.26100.33296, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815. Where patching must be delayed, reduce exposure of the QUIC attack surface: block inbound UDP/443 (and any other QUIC listener ports) at the perimeter and host firewall for systems that do not need HTTP/3 or SMB over QUIC, and disable SMB over QUIC on servers where it is not required (Set-SmbServerConfiguration / SMB over QUIC settings) - noting these controls will break HTTP/3 and remote QUIC-based SMB access respectively. Disabling HTTP/3 in IIS/edge services forces clients to fall back to HTTP/2 over TCP with minimal functional loss for most workloads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 9 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QUIC is a UDP-based, encrypted transport protocol (RFC 9000) used as the foundation for HTTP/3 and increasingly for SMB over QUIC, and Microsoft ships its own implementation, MsQuic, integrated into the Windows networking stack (msquic.sys / associated user-mode libraries). The root cause is a use-after-free (CWE-416): the code continues to reference a heap object after it has been freed, typically during connection state teardown, stream lifecycle handling, or packet reassembly. An attacker who controls the timing or sequencing of QUIC packets can cause a dangling pointer to be dereferenced, potentially allowing controlled reallocation of the freed region and hijack of program flow. Because QUIC parsing happens early in the connection lifecycle over the network, the vulnerable code is reachable before any application-layer authentication.
Know when Windows 11 23h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-facing QUIC handler (AV:N/PR:N/UI:N) with full impact, but AC:H because reliable use-after-free RCE requires heap grooming and race timing versus a simple crash.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft's MsQuic QUIC transport implementation contains a critical remote code execution vulnerability (CVE-2026-62815, CVSS 9.8) affecting Windows 11 and Windows Server 2022/2025 systems. An unauthenticated network attacker can trigger arbitrary code execution without user interaction, potentially compromising the entire system's confidentiality, integrity, and availability. This poses significant risk to organizational infrastructure, as no authentication or network access restrictions are required for exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Exploit-DB