GHSA-92f5-vc22-8j33
Dashboard / Vulnerabilities / GHSA-92f5-vc22-8j33
Summary: Microsoft QUIC: Remote Code Execution Vulnerability
Details: # Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. # Details New network path creations and removals triggered by incoming packets can lead to a pointer invalidation. ## Patches - Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b) # Impact An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
References: https://github.com/microsoft/msquic/security/advisories/GHSA-92f5-vc22-8j33, https://nvd.nist.gov/vuln/detail/CVE-2026-62815, https://github.com/microsoft/msquic/pull/6217, https://github.com/microsoft/msquic/pull/6219, https://github.com/microsoft/msquic/pull/6220, https://github.com/microsoft/msquic/commit/583e7d5b509bb0bfa3518482d98879b6eda41ad0, https://github.com/microsoft/msquic/commit/9ff06b71fd4b4d5258361598ada5b24cbc1beb20, https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b, https://github.com/microsoft/msquic, https://github.com/microsoft/msquic/releases/tag/v2.4.19, https://github.com/microsoft/msquic/releases/tag/v2.5.10, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815
Affected packages
Package
Name: Microsoft.Native.Quic.MsQuic.OpenSSL
Purl: pkg:nuget/Microsoft.Native.Quic.MsQuic.OpenSSL
Affected ranges
Type: ECOSYSTEM
Events:
