Microsoft QUIC: Heap-based buffer overflow enables remote code execution

Summary

A heap-based buffer overflow in Microsoft QUIC, the transport implementation used by Windows, .NET and Visual Studio, allows an unauthenticated attacker to execute code over the network. No user interaction or login is required, and the impact is rated total (confidentiality, integrity and availability) with a CVSS score of 9.8. Exposure depends mainly on whether Windows servers or .NET hosts that run QUIC or HTTP/3 services can be reached from untrusted networks.

Affected

• Windows 11 version 23H2 before 10.0.22631.7652
• Windows 11 version 24H2 before 10.0.26100.9711
• Windows 11 version 25H2 before 10.0.26200.9711
• Windows 11 version 26H1 before 10.0.28000.3231
• Windows 11 version 26H2 before 10.0.26300.9711
• Windows Server 2022 before 10.0.20348.5761
• Windows Server 2025 (including Server Core) before 10.0.26100.33650
• .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.14, .NET 11.0 before 11.0.0-rc.2.26504.105
• Visual Studio 2022 version 17.14 before 17.14.42, Visual Studio 2026 version 18.10 before 18.10.4
• NuGet package Microsoft.Native.Quic.MsQuic.Schannel: range given inconsistently by sources, verify against the GitHub advisory GHSA-5gjq-3f94-rcf7

Note: the version list was taken mainly from third-party aggregators and must be verified on the MSRC advisory.

Fixed in

• Install the October 2026 security updates for Windows, .NET, Visual Studio and the NuGet package (fixed builds as listed in the affected section, to be verified on MSRC).
• Fixed builds: Windows 11 23H2 10.0.22631.7652, 24H2 and 25H2 10.0.26100.9711 / 10.0.26200.9711, 26H1 10.0.28000.3231, 26H2 10.0.26300.9711, Windows Server 2022 10.0.20348.5761, Windows Server 2025 10.0.26100.33650.
• .NET 8.0.32, 9.0.21, 10.0.14, 11.0.0-rc.2.26504.105; Visual Studio 17.14.42 and 18.10.4; NuGet package 2.5.11-ci.159417053 or later.

Workaround

• No vendor workaround found in the sources reviewed. Patching is the documented fix.
• Own recommendation, not from a source: where patching is delayed, restrict inbound UDP/443 to the required minimum and disable HTTP/3 or QUIC on servers that do not need it, after testing application impact.

Exploitation

• Microsoft lists the vulnerability as not exploited at publication.
• No public proof-of-concept exploit and no confirmed in-the-wild exploitation were found in the sources reviewed.
• CISA SSVC: exploitation none, automatable yes, technical impact total. EPSS is 1.7 percent.
• Rapid7 rates exploitation as less likely; Action1 rates the patch as critical with same-day deployment.
• Status may change; recheck CISA KEV and vendor updates.

Our recommendation

• Patch Windows Server, Windows clients, .NET runtimes, Visual Studio and affected NuGet packages on the same day, starting with internet-facing servers and .NET hosts.
• Verify exact fixed builds on the MSRC advisory before rollout.
• Check which systems run QUIC or HTTP/3 services and limit inbound UDP/443 to required sources.
• Monitor for unusual UDP/443 traffic and crashes of QUIC-related services.
• Review the related October 2026 QUIC vulnerability CVE-2026-100219 together with this one.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105016 msrc.microsoft.com
• OpenCVE: CVE-2026-105016 app.opencve.io
• .NET announcement issue 446 github.com
• GitLab advisory: Microsoft.Native.Quic.MsQuic.Schannel advisories.gitlab.com
• Action1: Patch Tuesday October 2026 www.action1.com
• Rapid7: Patch Tuesday October 2026 www.rapid7.com
• Strix AI: CVE-2026-105016 www.strix.ai
• Talos: Microsoft Patch Tuesday October 2026 blog.talosintelligence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:55.