GHSA-gvvw-8j96-8g5rCriticalCVSS 9.8

MsQuic has a Remote Elevation of Privilege Vulnerability

Published
April 16, 2026
Last Modified
May 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-32179 →

📋 Description

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

  • Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

🎯 Affected products4

  • nuget/Microsoft.Native.Quic.MsQuic.OpenSSL:>= 2.5.0-ci.532574, < 2.5.7
  • nuget/Microsoft.Native.Quic.MsQuic.Schannel:>= 2.5.0-ci.532574, < 2.5.7
  • nuget/Microsoft.Native.Quic.MsQuic.Schannel:< 2.4.18
  • nuget/Microsoft.Native.Quic.MsQuic.OpenSSL:< 2.4.18

🔗 References (3)