Microsoft QUIC: NULL pointer dereference causes denial of service
Summary
A NULL pointer dereference in Microsoft QUIC, the QUIC transport implementation in Windows, allows an unauthenticated remote attacker to crash the affected service and cause a denial of service. The attack needs only network access to a QUIC-enabled service, with no user interaction. The CVSS vector shows no confidentiality or integrity impact, so the risk is availability, mainly for internet-facing Windows servers.
Affected
- Windows 11 version 23H2: 10.0.22631.0 to below 10.0.22631.7711
- Windows 11 version 24H2: 10.0.26100.0 to below 10.0.26100.9974
- Windows 11 version 25H2: 10.0.26200.0 to below 10.0.26200.9974
- Windows 11 version 26H1: 10.0.28000.0 to below 10.0.28000.3501
- Windows 11 version 26H2: 10.0.26300.0 to below 10.0.26300.9974
- Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5870
- Windows Server 2025 (including Server Core): 10.0.26100.0 to below 10.0.26100.33822
- Windows 10, Windows Server 2016 and 2019: Unknown.
Fixed in
- Install the cumulative security update released on 10 November 2026 (November 2026 Patch Tuesday).
- Fixed builds: see the affected list above. Verify the exact build and KB number for each product on the MSRC advisory.
- KB5132061 is reported for Windows 11 by a third-party source, not confirmed by MSRC. Unverified.
Workaround
Unknown. No vendor-documented workaround was found. Patching is the expected remedy.
Exploitation
- No evidence of exploitation in the wild found for CVE-2026-88236.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- CVSS temporal vector E:U (exploit maturity unproven).
- No public proof of concept found.
- The only exploited flaw named in the November 2026 release is CVE-2026-124194 (Outlook spoofing), not this CVE.
Our recommendation
- Prioritise patching internet-facing Windows servers and any servers running QUIC-based services (for example HTTP/3 or SMB over QUIC).
- Apply the November 2026 cumulative update to Windows 11 clients through the normal patch cycle.
- Check which systems have QUIC-enabled services and whether they are reachable from the internet.
- Verify the exact fixed build for each product on MSRC before rollout.
- Do not confuse this with CVE-2026-105016, a separate QUIC remote code execution flaw, and patch it as well.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-88236 www.cve.org
- Microsoft Security Update Guide CVE-2026-88236 msrc.microsoft.com
- strix.ai CVE-2026-88236 (third-party mirror) www.strix.ai
- NTCompatible: November 2026 Patch Tuesday www.ntcompatible.com
- BigGo: November 2026 Windows update report finance.biggo.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:07.
Original description (NVD)
Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.