Microsoft QUIC Library: Critical Unauthenticated RCE Flaw Disclosed (CVE-2026-62815)

Microsoft has disclosed a critical use-after-free vulnerability in its MsQuic library, tracked as CVE-2026-62815, carrying a CVSS score of 9.8. According to the GitHub Security Advisory (GHSA-92f5-vc22-8j33), the flaw stems from how new network path creations and removals — triggered by incoming packets — are handled, which can lead to pointer invalidation. A patch guarding path promotion has been published in commit e0f55b5.

Why It Matters

MsQuic is Microsoft's implementation of the QUIC transport protocol and ships as the NuGet packages Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel, used by any application or service that embeds QUIC transport on Windows or via .NET. Per the advisory, an unauthenticated attacker can exploit this remotely by sending a single specially crafted packet — no authentication or user interaction is required. A proof-of-concept is reportedly already public, which meaningfully lowers the bar for exploitation and raises the urgency for patching.

What Defenders Should Do Now

• Inventory any services, applications, or .NET components that reference the affected NuGet packages, and prioritize updating to a patched MsQuic build incorporating the path-promotion guard.
• Where QUIC-based services are internet-facing, treat this as a high-priority patch given the unauthenticated, no-interaction exploitation path.
• For hunting, look at crash/restart telemetry (unexpected process termination, watchdog restarts) on hosts running QUIC-enabled services, and monitor for anomalous or malformed QUIC packet bursts targeting UDP ports used by affected applications.
• Where WAF/network sensors have QUIC/UDP visibility, flag unusual path-creation/removal churn or malformed QUIC connection attempts as a starting hunting hypothesis, pending more detailed exploitation detail from the vendor.

This is developing intel published today with limited technical detail beyond the advisory itself; specifics of in-the-wild exploitation are not yet known. Defenders should track the original advisory for updates: GHSA-92f5-vc22-8j33.