Msquic
Monthly
Man-in-the-middle server impersonation affects Microsoft MsQuic client applications built against the OpenSSL or QuicTLS TLS backend at versions prior to 2.4.20, 2.5.11, and 2.6.1, because the client fails to verify that the server certificate matches the intended target hostname. An attacker who already holds an on-path position can present a mismatched certificate and terminate the QUIC connection as the spoofed server, enabling interception and modification of application data; the CVSS 4.0 vector (9.1) and the independent assessment (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) agree that the attack is unauthenticated, requires no user interaction, and is gated by the on-path positional prerequisite rather than by any credential. Deployments using the Schannel backend (including default Windows configurations) are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Man-in-the-middle server impersonation affects Microsoft MsQuic client applications built against the OpenSSL or QuicTLS TLS backend at versions prior to 2.4.20, 2.5.11, and 2.6.1, because the client fails to verify that the server certificate matches the intended target hostname. An attacker who already holds an on-path position can present a mismatched certificate and terminate the QUIC connection as the spoofed server, enabling interception and modification of application data; the CVSS 4.0 vector (9.1) and the independent assessment (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) agree that the attack is unauthenticated, requires no user interaction, and is gated by the on-path positional prerequisite rather than by any credential. Deployments using the Schannel backend (including default Windows configurations) are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.