CVE-2026-100219

CVE-2026-100219 is a use-after-free (CWE-416) in Microsoft QUIC that lets an unauthorized attacker execute code over the network. It is remotely reachable with low attack complexity and no privileges or user interaction, and successful exploitation can fully compromise confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The flaw affects Microsoft QUIC; the provided data does not name specific product builds or version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the Microsoft security update that fixes this QUIC use-after-free as soon as it is available for your Windows or MsQuic deployment, and confirm the patched build is installed. Until then, limit exposure of QUIC (typically UDP 443) to untrusted networks where practical and watch Microsoft guidance for the exact fixed versions.