CVE-2026-105016
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.99% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- Microsoft.Native.Quic.MsQuic.Schannel (nuget) = 2.5.11-ci.156755675, fixed in 2.5.11-ci.159417053 · GHSA-5gjq-3f94-rcf7