What is GHSA-2q33-cf8w-7q23?

GHSA-2q33-cf8w-7q23 is a security advisory published by GitHub Security Advisories with Critical severity. Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability

Why does GHSA-2q33-cf8w-7q23 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2q33-cf8w-7q23?

GHSA-2q33-cf8w-7q23 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-2q33-cf8w-7q23?

GHSA-2q33-cf8w-7q23 affects 1 product, including: nuget/Microsoft.Native.Quic.MsQuic.OpenSSL:\u003c 2.4.19.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 8, 2026

GHSA-2q33-cf8w-7q23CriticalCVSS 9.8Disclosed before NVD

Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability

Vendor

GitHub Security Advisories

Published

August 11, 2026

Last Modified

September 8, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-92f5-vc22-8j33. This link is maintained to preserve external references.

Original Description

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

🎯 Affected products1

nuget/Microsoft.Native.Quic.MsQuic.OpenSSL:< 2.4.19

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-62815
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815
https://github.com/advisories/GHSA-2q33-cf8w-7q23