CVE-2026-105016Suited to automated attack · CISA

Microsoft QUIC Remote Code Execution Vulnerability

CVSS score

9.8

EPSS probability

%1.0

Risk score

0.1

Published

5 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

CVE AI research

The stored explanation is shown at once; refreshing evaluates the sources again.

DayBreach AI Explanation

Verified against sources

Microsoft QUIC Remote Code Execution Vulnerability

Sources read

Source agreement

2/4

Evidence confidence

%68

Short explanation

A heap-based buffer overflow vulnerability in Microsoft QUIC (CVE-2026-105016) allows an unauthorized attacker to execute code over a network.

Why does it matter?

Rated critical, this vulnerability enables remote code execution over a network without requiring authentication or user interaction.

What should be done?

Install the latest servicing updates for supported .NET releases.
Update package references that directly use Microsoft.Native.Quic.MsQuic.Schannel.
Recompile and redeploy applications targeting the impacted versions.

Note on uncertainty

1 alanda kaynak uyuşmazlığı var. DayBreach bu değerleri saklamadı; kaynak karşılaştırması aşağıda gösteriliyor.

Chain of evidence and sources3 verified claims

Microsoft QUIC bileşeninde yığın tabanlı arabelük taşması açığı bulunmaktadır.

S0 · daybreach-canonical S1 · cvelist

Yetkisiz bir saldırgan ağ üzerinden kod çalıştırabilir.

S0 · daybreach-canonical S2 · nvd

Özel olarak hazırlanmış IPv6 QUIC paketleri kimlik doğrulama olmadan HTTP/3 yoluna ulaşabilir.

S4 · github

Show the technical text from the sources

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE: CWE-122

Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2026-105016 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	microsoft	.NET 10.0	View
2	microsoft	.NET 11.0	View
3	microsoft	.NET 8.0	View
4	microsoft	.NET 9.0	View
5	microsoft	Microsoft Visual Studio 2022 version 17.14	View
6	microsoft	Microsoft Visual Studio 2026 version 18.10	View
7	microsoft	Windows 11 version 23H2	View
8	microsoft	Windows 11 Version 24H2	View
9	microsoft	Windows 11 Version 25H2	View
10	microsoft	Windows 11 version 26H1	View
11	microsoft	Windows 11 Version 26H2	View
12	microsoft	windows server 2022	View
13	microsoft	windows server 2025	View
14	microsoft	Windows Server 2025 (Server Core installation)	View
15	nuget	Microsoft.Native.Quic.MsQuic.Schannel	View

Total affected vendors: 2|Products: 15

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
9.8	CVSS V31	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD
9.8	CVSS 3.x	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Microsoft MSRC
9.8	CVSS V3_1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	CVE CNA
9.8	CVSS 3.x	—	Vector not published	GitHub Advisory
0.0	CVSS 4.0	—	Vector not published	GitHub Advisory

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

23 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

cvelist

Microsoft QUIC Remote Code Execution Vulnerability

Open source

reference

Microsoft QUIC Remote Code Execution Vulnerability

Open source

reference

5126655

Open source

reference

Yama veya çözüm referansı

Open source

reference

5126653

Open source

reference

Yama veya çözüm referansı

Open source

reference

5127648

Open source

reference

Yama veya çözüm referansı

Open source

reference

5126646

Open source

reference

Yama veya çözüm referansı

Open source

reference

5127646

Open source

reference

Yama veya çözüm referansı

Open source

Confirm the affected product and version against the source evidence above.

Restrict access to internet-facing services and apply network segmentation.

Apply the official update named in the evidence only to the matching product and version.

Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-105016 is associated with the following CWEs:

CWE-122: Common Weakness Enumeration Entry CWE-122

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-105016 weaknesses.

CAPEC-66: SQL Injection CAPEC-126: Path Traversal CAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden

PermissionsGerekmiyor

UserGerekmiyor

Official Sources and Advisories

Microsoft QUIC Remote Code Execution Vulnerabilitypatch 5126655patch https://support.microsoft.com/help/5126655patch 5126653patch https://support.microsoft.com/help/5126653patch 5127648patch https://support.microsoft.com/help/5127648patch 5126646patch https://support.microsoft.com/help/5126646patch 5127646patch

CVSS Vector Radar Chart

9.8 / 10

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone required

User InteractionNone required

Confidentiality (Gizlilik)Low

Integrity (Bütünlük)None

Availability (Erişilebilirlik)High

Yama doğrulandı

23 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

microsoft

nuget

Weakness Type (CWE & CAPEC)

CWE-122

Similar Vulnerabilities

10.0

CVE-2020-0796 Actively exploitedMemory buffer overflow in Microsoft Windows 10 Version 1903 For 32 Bit Systems

Vendormicrosoft ProductWindows 10 Version 1903 for 32-bit Systems+12 etkilenen

Patch verified Public Exploits:4EPSS %1006 y ago

9.8

CVE-2025-53770 Actively exploitedMicrosoft SharePoint Server Remote Code Execution Vulnerability

Vendormicrosoft ProductMicrosoft SharePoint Enterprise Server 2016+3 etkilenen

Patch verified Public Exploits:12EPSS %1001 y ago

9.8

CVE-2025-59287 Actively exploitedWindows Server Update Service (WSUS) Remote Code Execution Vulnerability

Vendormicrosoft Productwindows

Patch verified Public Exploits:10EPSS %1001 y ago

9.8

CVE-2021-38647 Actively exploitedOpen Management Infrastructure (OMI) Remote Code Execution Vulnerability

Vendormicrosoft ProductAzure Automation State Configuration, DSC Extension+11 etkilenen

Patch verified Public Exploits:10EPSS %1005 y ago

9.8

CVE-2024-21413 Actively exploitedMicrosoft Outlook Remote Code Execution Vulnerability

Vendormicrosoft ProductMicrosoft 365 Apps for Enterprise+7 etkilenen

Patch verified Public Exploits:7EPSS %952 y ago

9.1

CVE-2021-34473 Actively exploitedMicrosoft Exchange Server Remote Code Execution Vulnerability

Vendormicrosoft ProductMicrosoft Exchange Server 2013 Cumulative Update 23+5 etkilenen

Patch verified Public Exploits:9EPSS %1005 y ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-105016"

Microsoft QUIC Remote Code Execution Vulnerability

Impact on My Inventory

Vulnerability description

DayBreach AI Explanation

Short explanation

What should be done?

IMPACT: Affected Products and Software

Affected Products

RED HAT CSAF/VEX: Product Impact Check

SCORING: CVSS from Multiple Sources

CVSS Scores

Patch and Remediation Guide

Solution & Remediation Advisory

Public exploit and active exploitation status

Verified exploit intelligence

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

Common Attack Pattern Enumeration and Classification (CAPEC)

Attack Vector and Accessibility

Official Sources and Advisories

CVSS Vector Radar Chart

Vulnerability Scoring Details

Weakness Type (CWE & CAPEC)

Similar Vulnerabilities

Get this vulnerability through the API

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration