CVE-2026-62815

A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.

What to do: Update MsQuic to a build containing the 'Guard path promotion' fix (commit e0f55b5) and apply Microsoft's patched Windows builds as they are published. Inventory hosts running QUIC-enabled services (e.g., HTTP/3 and SMB over QUIC listening on UDP/443) and restrict their internet exposure at the perimeter as an interim mitigation. Monitor the Microsoft advisory for the definitive list of affected versions.