Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Various vulnerabilities in MsQuic are addressed by an updated native-binary dependency update.
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A crafted IPv6 QUIC packet can reach the Microsoft QUIC HTTP/3 path without authentication or user interaction and trigger remote code execution.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.
Impact The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service. Patches The following patch was made: Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9 Workarounds Beyond upgrading to the patched versions, there is no other workaround. MSRC CVE Info https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190
Microsoft QUIC Denial of Service Vulnerability
Microsoft QUIC Denial of Service Vulnerability