CVE-2026-62898: .NET MsQuic Use After Free Information Disclosure
A use-after-free bug in the native MsQuic library bundled with .NET lets any remote attacker read process memory over the network, leaking potentially sensitive data without any authentication.
The problem
Microsoft QUIC (MsQuic) is the native QUIC implementation shipped inside .NET Windows runtimes. A use-after-free condition in its connection or stream handling code allows memory that has already been freed to be read back by a remote peer.
Because QUIC is a network-facing protocol with no authentication required at the transport layer, an unauthenticated attacker can trigger the bug from the internet. Successful exploitation leaks heap contents, which may include cryptographic material, session tokens, or other in-process data.
CVSS 7.5 (AV:N/AC:L/PR:N/UI:N).
The fix
Update to .NET 10.0.11, 9.0.19, or 8.0.30, which ship a patched MsQuic build. Run dotnet --info to check your installed runtime version. Self-contained applications must be recompiled against the patched SDK and redeployed. On Windows, the updated msquic.dll is included in the runtime package, so a machine-wide runtime update is sufficient for framework-dependent apps.
Restart all affected services after updating.
Related research
- high · 7.5CVE-2026-62901CVE-2026-62901: .NET System.Net.WebSockets Denial of Service via Unchecked Loop Condition
- high · 7CVE-2026-62897CVE-2026-62897: .NET WPF Integer Overflow Remote Code Execution
- high · 7.8CVE-2026-62871CVE-2026-62871: WPF .NET Desktop Runtime Heap Buffer Overflow Elevation of Privilege
- high · 7.8CVE-2026-70354CVE-2026-70354: .NET WPF Out-of-Bounds Write Remote Code Execution