Microsoft patches critical QUIC remote code execution flaw in .NET packages

Microsoft has released a security update to address a critical remote code execution vulnerability in its QUIC protocol implementation. The flaw, identified as CVE-2026-105016, affects applications built with specific versions of .NET on Windows systems. An attacker can exploit this issue without authentication or user interaction by sending a crafted IPv6 QUIC packet.

The vulnerability stems from a heap-based buffer overflow within the Microsoft QUIC library. According to the National Vulnerability Database, the issue is classified as critical with a CVSS score of 9.8. The weakness allows an unauthorized attacker to execute arbitrary code over a network. The flaw is categorized under CWE-122, indicating a failure to properly manage memory boundaries during packet processing.

Technical Context and Scope

The advisory from Microsoft’s Security Update Guide specifies that the vulnerability impacts the HTTP/3 path within the QUIC protocol. Attackers can trigger the remote code execution by delivering a specially crafted IPv6 packet to the affected service. This method requires no prior access credentials or user engagement, making the attack vector particularly dangerous for exposed network services.

The GitHub security advisory GHSA-5gjq-3f94-rcf7 confirms the critical severity rating. The CVSS 3.1 vector string `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects the ease of exploitation and high impact on confidentiality, integrity, and availability. The issue affects all Windows architectures where the vulnerable package is deployed.

Affected Versions and Platforms

This vulnerability specifically targets Microsoft .NET projects utilizing the `Microsoft.Native.Quic.MsQuic.Schannel` NuGet package. Version 2.5.11-ci.156755675 is confirmed vulnerable, while version 2.5.11-ci.159417053 contains the necessary fixes. The advisory notes that the flaw affects .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 environments running on Windows.

Developers using these .NET releases must verify their package dependencies. If an application directly references the affected version of the Schannel package, it is exposed to potential exploitation. The Microsoft advisory indicates that the issue is present in the native QUIC implementation used by these specific .NET iterations.

What should you do?

Microsoft recommends installing the latest servicing update for supported .NET releases to mitigate this risk. For developers who reference the `Microsoft.Native.Quic.MsQuic.Schannel` package directly, updating to version 2.5.11-ci.159417053 or later is required. Users with Visual Studio installed should update their IDE, as this process also updates the associated .NET SDKs.