Microsoft QUIC Heap Overflow Patches Available for .NET 8 Through 11 on Windows

Microsoft has released a fix for a critical remote code execution vulnerability in its QUIC implementation. The flaw, tracked as CVE-2026-105016, allows attackers to execute code on Windows systems running affected .NET versions without any user interaction or authentication.

What happened

Microsoft identified a heap-based buffer overflow in its QUIC networking library. According to the National Vulnerability Database, the flaw receives a CVSS score of 9.8, rating it as critical. An attacker can exploit this weakness by sending a crafted IPv6 QUIC packet to a vulnerable application. This action triggers the buffer overflow and leads to remote code execution on the target system.

The vulnerability specifically impacts applications built with .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. The issue resides in the Microsoft QUIC HTTP/3 path. Attackers do not need to authenticate to the application to trigger the exploit. The flaw is classified under CWE-122, which denotes heap-based buffer overflows.

Why it matters

The risk is elevated because exploitation requires no user interaction. Attackers can target any exposed service using the affected .NET versions and the vulnerable QUIC package. The National Vulnerability Database confirms the high severity score due to the network-based attack vector and lack of privilege requirements.

Microsoft states that the vulnerability affects projects using specific versions of the Microsoft.Native.Quic.MsQuic.Schannel NuGet package. Applications using version 2.5.11-ci.156755675 are exposed. The vendor has provided a patched version, 2.5.11-ci.159417053, to resolve the issue.

What to watch

Teams should monitor their deployment pipelines for the specific package version mentioned in the advisory. They must verify that builds include the patched version of the Microsoft.Native.Quic.MsQuic.Schannel package. Security teams should also watch for any new indicators of compromise related to crafted IPv6 QUIC packets.

Who needs to act first

Organizations should prioritize updating internet-facing services that rely on .NET 8 through 11. Teams usually begin by identifying systems exposed to untrusted networks. It is prudent to test updates in a non-production environment before rolling them out widely. Backing up current configurations ensures recovery if an update causes compatibility issues.

What to do and how to stay safe: Microsoft

• Review all .NET applications for references to the Microsoft.Native.Quic.MsQuic.Schannel package.
• Update the package to version 2.5.11-ci.159417053 or later in affected projects.
• Install the latest servicing update for supported .NET releases on Windows servers.
• Monitor network logs for unusual IPv6 QUIC traffic patterns that may indicate exploitation attempts.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-105016?

The vulnerability affects .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows.

Is there a fix available for this vulnerability?

Yes, Microsoft has released a patched version of the Microsoft.Native.Quic.MsQuic.Schannel package, version 2.5.11-ci.159417053.

How can an attacker exploit this flaw?

An attacker can send a crafted IPv6 QUIC packet to trigger a heap-based buffer overflow and execute code remotely.