CVE-2026-105016: Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

October 13, 2026

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.

References

github.com/advisories/GHSA-5gjq-3f94-rcf7
github.com/dotnet/announcements/issues/446
github.com/dotnet/runtime/issues/135695
github.com/dotnet/runtime/security/advisories/GHSA-5gjq-3f94-rcf7
nvd.nist.gov/vuln/detail/CVE-2026-105016

Code Behaviors & Features

Detect and mitigate CVE-2026-105016 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →