Read the docs
TI-2026-72734 Aliases CVE-2026-85790GHSA-2mxg-prvg-9jfg

Use after free in Microsoft QUIC allows information disclosure

Priority LOW 28CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Use after free in Microsoft QUIC affects Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft.Native.Quic.MsQuic.Schannel, Windows 11 version 23H2, Windows 11 Version 24H2 and other products. This flaw (CWE-416) lets an unauthorized attacker disclose information over a network. The attack is highly complex and requires no privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00804 56th percentileScored 2026-11-07
Fix Fixed Microsoft Visual Studio 2022 version 17.14 (Microsoft): 17.14.42Microsoft Visual Studio 2026 version 18.10 (Microsoft): 18.10.4+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 to before 17.14.4217.14.42Patch availableCNA
MicrosoftMicrosoft Visual Studio 2026 version 18.1018.10.0 to before 18.10.418.10.4Patch availableCNA
MicrosoftMicrosoft.Native.Quic.MsQuic.Schannel1.9.0 to before 2.6.22.6.2Patch availableCNA
MicrosoftWindows 11 version 23H210.0.22631.0 to before 10.0.22631.765210.0.22631.7652Patch availableCNA
MicrosoftWindows 11 Version 23H210.0.22631.0 to before 10.0.22631.765210.0.22631.7652Patch availableCNA
MicrosoftWindows 11 Version 24H210.0.26100.0 to before 10.0.26100.971110.0.26100.9711Patch availableCNA
MicrosoftWindows 11 Version 25H210.0.26200.0 to before 10.0.26200.971110.0.26200.9711Patch availableCNA
MicrosoftWindows 11 version 26H110.0.28000.0 to before 10.0.28000.323110.0.28000.3231Patch availableCNA
MicrosoftWindows 11 Version 26H210.0.26300.0 to before 10.0.26300.971110.0.26300.9711Patch availableCNA
MicrosoftWindows Server 202210.0.20348.0 to before 10.0.20348.576110.0.20348.5761Patch availableCNA
MicrosoftWindows Server 202510.0.26100.0 to before 10.0.26100.3365010.0.26100.33650Patch availableCNA
MicrosoftWindows Server 2025 (Server Core installation)10.0.26100.0 to before 10.0.26100.3365010.0.26100.33650Patch availableCNA
—Microsoft.Native.Quic.MsQuic.Schannel (NuGet)1.9.0 to before 2.5.122.5.12Patch availableGHSA-2mxg-prvg-9jfg
—Microsoft.Native.Quic.MsQuic.Schannel (NuGet)2.6.0 to before 2.6.32.6.3Patch availableGHSA-2mxg-prvg-9jfg
  • Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.42 Fixed in 17.14.42 Patch available CNA
  • Microsoft Visual Studio 2026 version 18.10 VendorMicrosoft Affected 18.10.0 to before 18.10.4 Fixed in 18.10.4 Patch available CNA
  • Microsoft.Native.Quic.MsQuic.Schannel VendorMicrosoft Affected 1.9.0 to before 2.6.2 Fixed in 2.6.2 Patch available CNA
  • Windows 11 version 23H2 VendorMicrosoft Affected 10.0.22631.0 to before 10.0.22631.7652 Fixed in 10.0.22631.7652 Patch available CNA
  • Windows 11 Version 23H2 VendorMicrosoft Affected 10.0.22631.0 to before 10.0.22631.7652 Fixed in 10.0.22631.7652 Patch available CNA
  • Windows 11 Version 24H2 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.9711 Fixed in 10.0.26100.9711 Patch available CNA
  • Windows 11 Version 25H2 VendorMicrosoft Affected 10.0.26200.0 to before 10.0.26200.9711 Fixed in 10.0.26200.9711 Patch available CNA
  • Windows 11 version 26H1 VendorMicrosoft Affected 10.0.28000.0 to before 10.0.28000.3231 Fixed in 10.0.28000.3231 Patch available CNA
  • Windows 11 Version 26H2 VendorMicrosoft Affected 10.0.26300.0 to before 10.0.26300.9711 Fixed in 10.0.26300.9711 Patch available CNA
  • Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.5761 Fixed in 10.0.20348.5761 Patch available CNA
  • Windows Server 2025 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
  • Windows Server 2025 (Server Core installation) VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
  • Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Vendor— Affected 1.9.0 to before 2.5.12 Fixed in 2.5.12 Patch available GHSA-2mxg-prvg-9jfg
  • Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Vendor— Affected 2.6.0 to before 2.6.3 Fixed in 2.6.3 Patch available GHSA-2mxg-prvg-9jfg

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*before 10.0.22631.7652VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*before 10.0.22631.7652VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*before 10.0.26100.9711VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*before 10.0.26100.9711VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*before 10.0.26200.9711VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*before 10.0.26200.9711VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*before 10.0.28000.3231VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*before 10.0.28000.3231VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*before 10.0.26300.9711VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*before 10.0.26300.9711VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* Versions before 10.0.22631.7652 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* Versions before 10.0.22631.7652 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26100.9711 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* Versions before 10.0.26100.9711 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26200.9711 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* Versions before 10.0.26200.9711 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* Versions before 10.0.28000.3231 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* Versions before 10.0.28000.3231 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26300.9711 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* Versions before 10.0.26300.9711 Vulnerable ·Microsoft
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*before 10.0.20348.5761VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*before 10.0.26100.33650VulnerableMicrosoft
cpe:2.3:a:microsoft:native.quic.msquic.schannel:*:*:*:*:*:*:*:*before 2.6.2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:8.0.0:*:*:*:*:*:*:*8.0.0Running onMicrosoft
cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:*9.0.0Running onMicrosoft
cpe:2.3:a:microsoft:.net:10.0.0:*:*:*:*:*:*:*10.0.0Running onMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:*:*:*:*:*:*:*11.0.0Running onMicrosoft
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*17.14.0 to before 17.14.42VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*18.10.0 to before 18.10.4VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* Versions before 10.0.20348.5761 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* Versions before 10.0.26100.33650 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:native.quic.msquic.schannel:*:*:*:*:*:*:*:* Versions before 2.6.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Running on ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.14.0 to before 17.14.42 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:* Versions 18.10.0 to before 18.10.4 Vulnerable ·Microsoft

Remediation

Apply the fixed versions: Microsoft Visual Studio 2022 17.14.42, Microsoft Visual Studio 2026 18.10.4, Microsoft.Native.Quic.MsQuic.Schannel 2.5.12, 2.6.2 and 2.6.3, Windows 11 version 23H2 10.0.22631.7652, Windows 11 Version 24H2 10.0.26100.9711, Windows 11 Version 25H2 10.0.26200.9711, Windows 11 version 26H1 10.0.28000.3231, Windows 11 Version 26H2 10.0.26300.9711, Windows Server 2022 10.0.20348.5761 and Windows Server 2025 10.0.26100.33650.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Microsoft Visual Studio 2022 version 17.14 (Microsoft) Fixed in 17.14.42
  • Fix · CNA Microsoft Visual Studio 2026 version 18.10 (Microsoft) Fixed in 18.10.4
  • Fix · CNA Microsoft.Native.Quic.MsQuic.Schannel (Microsoft) Fixed in 2.6.2
  • Fix · CNA Windows 11 version 23H2 (Microsoft) Fixed in 10.0.22631.7652
  • Fix · CNA Windows 11 Version 23H2 (Microsoft) Fixed in 10.0.22631.7652
  • Fix · CNA Windows 11 Version 24H2 (Microsoft) Fixed in 10.0.26100.9711
  • Fix · CNA Windows 11 Version 25H2 (Microsoft) Fixed in 10.0.26200.9711
  • Fix · CNA Windows 11 version 26H1 (Microsoft) Fixed in 10.0.28000.3231
  • Fix · CNA Windows 11 Version 26H2 (Microsoft) Fixed in 10.0.26300.9711
  • Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.5761
  • Fix · CNA Windows Server 2025 (Microsoft) Fixed in 10.0.26100.33650
  • Fix · CNA Windows Server 2025 (Server Core installation) (Microsoft) Fixed in 10.0.26100.33650
  • Fix · GHSA-2mxg-prvg-9jfg Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Fixed in 2.5.12 Advisory →
  • Fix · GHSA-2mxg-prvg-9jfg Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Fixed in 2.6.3 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-85790
  2. 2026-10-13 Alias added: GHSA-2mxg-prvg-9jfg
  3. 2026-10-13 Fix available: NuGet/[email protected] · GHSA-2mxg-prvg-9jfg
  4. 2026-10-13 CVSS score added · GHSA-2mxg-prvg-9jfg
  5. 2026-10-13 Weakness changed · GHSA-2mxg-prvg-9jfg
  6. 2026-10-13 4 new references · GHSA-2mxg-prvg-9jfg
  7. 2026-10-19 Fix available: NuGet/[email protected], NuGet/[email protected] · GHSA-2mxg-prvg-9jfg

References

Patch 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences