Microsoft QUIC Heap Corruption CVE-2026-105016 Enables Critical Unauthenticated RCE in .NET 8-11 Windows

Microsoft has released guidance addressing a critical remote code execution vulnerability in its QUIC networking implementation. The flaw allows an unauthorised attacker to execute code over a network without any user interaction or authentication. This issue impacts .NET applications running on Windows systems that utilise the affected QUIC library versions.

Root cause

The underlying issue is a heap-based buffer overflow within the Microsoft QUIC component. According to the GitHub advisory, this weakness is classified as CWE-122. A buffer overflow occurs when a program writes more data to a memory buffer than it can hold. In this specific case, the overflow happens on the heap, a region of memory used for dynamic allocation.

Attack path

An attacker can exploit this vulnerability by sending a specially crafted IPv6 QUIC packet. This packet can reach the Microsoft QUIC HTTP/3 path without requiring authentication. Once received, the malformed packet triggers the buffer overflow, leading to remote code execution on the targeted Windows system. No user interaction is necessary for the exploit to succeed.

Affected versions

The vulnerability affects projects using specific versions of the Microsoft.Native.Quic.MsQuic.Schannel NuGet package. The affected version is 2.5.11-ci.156755675. This component is used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 applications on Windows platforms. All Windows architectures are susceptible to this attack vector.

Mitigation

Developers should update their applications to remove the vulnerability. Microsoft advises installing the latest servicing update for supported .NET releases. If the application directly references the vulnerable package, developers must update the reference to version 2.5.11-ci.159417053 or later. Visual Studio users may be prompted to update their SDKs, which includes this fix.

Why it matters

Remote code execution vulnerabilities allow attackers to take full control of a system. This is particularly dangerous when no authentication is required, as it means the attacker does not need stolen credentials. Heap overflows are complex to detect and can persist in systems for long periods. Teams should prioritise patching these components immediately to prevent unauthorised access and maintain the integrity of their network infrastructure.

Background: Heap overflow vulnerabilities

Enable compiler hardening flags such as stack protectors and control flow integrity during build time. Replace raw pointer arithmetic with bounds-checked containers in new code. Deploy automated fuzzing to catch out-of-bounds writes before they reach production. These steps reduce the attack surface significantly.

Read the full guide: Prevent Heap Overflows: Compiler Hardening and Modern Memory Safety

What to do and how to stay safe: Microsoft

• Verify if your .NET applications reference the Microsoft.Native.Quic.MsQuic.Schannel package and check the version number.
• Update to version 2.5.11-ci.159417053 or later if you are using the affected package directly.
• Install the latest servicing updates for .NET 8, 9, 10, or 11 RC2 on your Windows systems.
• Monitor network traffic for unusual IPv6 QUIC packet patterns that might indicate an exploitation attempt.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-105016?

The vulnerability affects .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows platforms.

What is the CVSS score for this vulnerability?

The Common Vulnerability Scoring System (CVSS) score is 9.8, which is rated as critical severity.

Is there a patched version available?

Yes, Microsoft has released version 2.5.11-ci.159417053 of the Microsoft.Native.Quic.MsQuic.Schannel package to fix the issue.