CVE-2026-105016
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
Published Oct 13, 2026 · updated Oct 16, 2026 · Microsoft Windows
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
Oct 14, 2026 · CIRCL Vulnerability Lookup
Updated
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Oct 16, 2026 · NIST NVD
Updated
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Affected
- microsoft .NET 10.0 installed on Windowsversion unspecified
- microsoft .NET 11.0 installed on Windowsversion unspecified
- microsoft .NET 8.0 installed on Windowsversion unspecified
- microsoft .NET 9.0 installed on Windowsversion unspecified
- microsoft Windows 11 Version 24H2 for ARM64-based Systemsversion unspecified
- microsoft Windows 11 Version 25H2 for ARM64-based Systemsversion unspecified
- microsoft Windows 11 Version 26H1 for ARM64-based Systemsversion unspecified
- microsoft Windows 11 Version 26H2 for ARM64-based Systemsversion unspecified
- microsoft Windows 11 Version 26H2 for x64-based Systemsversion unspecified
- microsoft Windows 11 version 26H1 for x64-based Systemsversion unspecified
- microsoft Windows Server 2025version unspecified
- microsoft Windows Server 2025 (Server Core installation)version unspecified
- nuget microsoft.native.quic.msquic.schannelversion unspecified
- vendor Microsoft .NET 10.0version unspecified
- vendor Microsoft .NET 11.0version unspecified
- vendor Microsoft .NET 8.0version unspecified
- vendor Microsoft .NET 9.0version unspecified
- vendor Microsoft Microsoft Visual Studio 2022 version 17.14version unspecified
- vendor Microsoft Microsoft Visual Studio 2026 version 18.10version unspecified
- vendor Microsoft Windows 11 Version 23H2version unspecified
- vendor Microsoft Windows 11 version 23H2version unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-105016
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-105016
30-day exploitation probability 1.0%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-105016
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user
advisories.gitlab.com - Microsoft Security Update GuideVendor advisoryCVE-2026-105016
Windows 11 Version 26H2 for ARM64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows Server 2025
msrc.microsoft.com - NCSC NetherlandsGovernment advisoryCVE-2026-105016
Microsoft heeft 1159 kwetsbaarheden verholpen in Windows. Het voert te ver om iedere kwetsbaarheid te benoemen. De 53 ernstigste kwetsbaarheden, met een CVSS score van 9 en hoger zijn weergegeven in onderstaande lijst en geven een kwaadwillende de mogelijkheid om zich voor te doe
advisories.ncsc.nl - NIST NVDVulnerability recordCVE-2026-105016
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
nvd.nist.gov