CVE-2026-62815: MsQuic (Microsoft QUIC) Use After Free Remote Code Execution
A use-after-free bug in MsQuic's connection path migration logic lets an unauthenticated remote attacker crash or execute code on any server that accepts QUIC traffic, with no login or user…
The problem
MsQuic versions 2.5.3 through 2.5.9 mismanage memory during QUIC connection path migration. When a server processes incoming packets that create or remove network paths, a path pointer can be promoted to the active path after the underlying object has already been freed.
The result is a classic use-after-free (CWE-416). Any service that listens on QUIC (UDP/443) is exposed, including Windows servers running HTTP/3, SMB over QUIC, or any application linking against the MsQuic library. No handshake or authentication is needed to reach the vulnerable code path.
The fix
Upgrade to MsQuic 2.5.10 or later (NuGet package Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.10). Windows system components are covered by the August 2026 Patch Tuesday cumulative update. If immediate patching is not possible, block external UDP/443 traffic at the perimeter to reduce exposure surface until the update can be applied.
Reported by Guillaume Hetier (Microsoft).
Related research
- high · 7.5CVE-2026-62898CVE-2026-62898: .NET MsQuic Use After Free Information Disclosure
- high · 7.5SIPSorcery SCTP SACK Chunk Out-of-Bounds Read DoS
- high · 7.5SIPSorcery TurnServer UDP Receive Loop Denial of Service
- high · 7.1CVE-2026-48798CVE-2026-48798: SSH.NET ScpClient Recursive Download Path Traversal