Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

{
  "id": "d7279900b8d12feb8ab5efac50914928821e915daa0559ccb437821663b681b0",
  "url": "https://osv.dev/vulnerability/GHSA-5gjq-3f94-rcf7",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability",
    "summary": "## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/446 ## CVSS Details - **Version:** 3.1 - **Severity:** Critical - **Score:** 9.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` - **Weakness:** CWE-122 (Heap-based Buffer Overflow) ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.Native.Quic.MsQuic.Schannel](https://www.nuget.org/packages/Microsoft.Native.Quic.MsQuic.Schannel) | >= 2.5.11-ci.156755675, <= 2.5.11-ci.156755675 | 2.5.11-ci.159417053 ## Advisory FAQ ### How do I know if I am affected? If your application uses a package version listed in [affected packages](#affected-packages), it is exposed to the vulnerability. ### How do I fix the issue? 1. Install the latest servicing update for yo",
    "evidence": "osv:GHSA-5gjq-3f94-rcf7",
    "products": [
      {
        "name": {
          "value": "Microsoft.Native.Quic.MsQuic.Schannel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.5.11-ci.159417053",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "2.5.11-ci.156755675",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "GHSA-5gjq-3f94-rcf7",
      "aliases": [
        "CVE-2026-105016",
        "GHSA-5gjq-3f94-rcf7"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.5.11-ci.156755675"
                },
                {
                  "fixed": "2.5.11-ci.159417053"
                }
              ]
            }
          ],
          "package": {
            "name": "Microsoft.Native.Quic.MsQuic.Schannel",
            "purl": "pkg:nuget/Microsoft.Native.Quic.MsQuic.Schannel",
            "ecosystem": "NuGet"
          },
          "versions": [
            "2.5.11-ci.156755675"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5gjq-3f94-rcf7/GHSA-5gjq-3f94-rcf7.json"
          }
        }
      ],
      "modified": "2026-10-13T20:00:04.412903941Z",
      "provider": "osv",
      "references": [
        "https://github.com/dotnet/runtime/security/advisories/GHSA-5gjq-3f94-rcf7",
        "https://github.com/dotnet/announcements/issues/446",
        "https://github.com/dotnet/runtime/issues/135695",
        "https://github.com/dotnet/runtime"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-122"
        ],
        "severity": "CRITICAL",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-13T19:56:35Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-105016",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 313677,
  "published_at": "2026-10-13T19:56:35+00:00"
}