CVE-2026-105016

CVE-2026-105016 is a heap-based buffer overflow (CWE-122) in Microsoft QUIC, Microsoft's QUIC implementation also distributed through the NuGet ecosystem. An unauthorized attacker can trigger it over the network with no privileges and no user interaction. Successful exploitation can run arbitrary code on the affected system with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Windows hosts and applications that use MsQuic, including .NET consumers of the NuGet package, are in scope, although the advisory data does not name a version range. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Install Microsoft's security update for the Microsoft QUIC (MsQuic) component and upgrade any application that consumes the MsQuic NuGet package to the fixed build as soon as it is published. Until then, limit QUIC listeners (typically UDP 443 and other QUIC ports) to trusted networks. No fixed version range was included in the advisory data provided here, and there is no known public exploit, but the issue is critical unauthenticated remote code execution and should be patched promptly.