Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Microsoft .NET may let attackers execute code remotely

CVE-2026-105016 · published 22 days ago
Summary

Versions 8.0 through 11.0 of Microsoft .NET and Visual Studio 2022 can be tricked into running malicious code over the network because of a memory handling error. This could allow an outsider to take control of affected servers or computers. Apply the latest security updates from Microsoft as soon as possible to protect your systems.

What to do
  • Update microsoft.native.quic.msquic.schannel to version 2.5.11-ci.159417053.
  • Update microsoft .net 10.0 to version 10.0.14 or later.
  • Update microsoft .net 11.0 to version 11.0.0-rc.2.26504.105 or later.
  • Update microsoft .net 8.0 to version 8.0.32 or later.
  • Update microsoft .net 9.0 to version 9.0.21 or later.
  • Update microsoft microsoft visual studio 2022 version 17.14 to version 17.14.42 or later.
  • Update microsoft microsoft visual studio 2026 version 18.10 to version 18.10.4 or later.
  • Update microsoft windows 11 version 23h2 to version 10.0.22631.7652 or later.
  • Update microsoft windows 11 version 24h2 to version 10.0.26100.9711 or later.
  • Update microsoft windows 11 version 25h2 to version 10.0.26200.9711 or later.
  • Update microsoft windows 11 version 26h1 to version 10.0.28000.3231 or later.
  • Update microsoft windows 11 version 26h2 to version 10.0.26300.9711 or later.
  • Update microsoft windows server 2022 to version 10.0.20348.5761 or later.
  • Update microsoft windows server 2025 to version 10.0.26100.33650 or later.
  • Update microsoft windows server 2025 (server core installation) to version 10.0.26100.33650 or later.
  • Update microsoft .net 10.0 runtime to version 10.0.14 or later.
  • Update microsoft .net 11.0 runtime to version 11.0.0-rc.2.26504.105 or later.
  • Update microsoft .net 8.0 runtime to version 8.0.32 or later.
  • Update microsoft .net 9.0 runtime to version 9.0.21 or later.
Affected software
Ecosystem VendorProductAffected versions
– microsoft .net 10.0 < 10.0.14
– microsoft .net 11.0 < 11.0.0-rc.2.26504.105
– microsoft .net 8.0 < 8.0.32
– microsoft .net 9.0 < 9.0.21
– microsoft microsoft visual studio 2022 version 17.14 < 17.14.42
– microsoft microsoft visual studio 2026 version 18.10 < 18.10.4
– microsoft windows 11 version 23h2 < 10.0.22631.7652
– microsoft windows 11 version 24h2 < 10.0.26100.9711
– microsoft windows 11 version 25h2 < 10.0.26200.9711
– microsoft windows 11 version 26h1 < 10.0.28000.3231
– microsoft windows 11 version 26h2 < 10.0.26300.9711
– microsoft windows server 2022 < 10.0.20348.5761
– microsoft windows server 2025 < 10.0.26100.33650
– microsoft windows server 2025 (server core installation) < 10.0.26100.33650
nuget – microsoft.native.quic.msquic.schannel 2.5.11-ci.156755675
Fix: upgrade to 2.5.11-ci.159417053
Ubuntu:22.04:LTS canonical dotnet7 All versions
– microsoft .net 10.0 runtime < 10.0.14
– microsoft .net 11.0 runtime < 11.0.0-rc.2.26504.105
– microsoft .net 8.0 runtime < 8.0.32
– microsoft .net 9.0 runtime < 9.0.21
Original advisory text
Microsoft QUIC Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published13 Oct 2026
Updated4 Nov 2026
First seen13 Oct 2026
Sources
CVE-2026-105016 · NVD
CVE-2026-105016 · MITRE
GHSA-5gjq-3f94-rcf7 · GHSA
UBUNTU-CVE-2026-105016 · OSV
Track software like this
Free during beta