{"uuid": "99da58e9-82a0-4475-99c3-a16dd0b2f88d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62898", "type": "seen", "source": "https://gist.github.com/alon710/0e53d71b7aead8a8df5c63101e1c6259", "content": "# CVE-2026-62898: CVE-2026-62898: Use After Free Information Disclosure in Microsoft QUIC\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62898\n\n## Summary\nA critical use-after-free vulnerability in Microsoft QUIC allows unauthenticated remote attackers to disclose sensitive system memory over the network. The vulnerability is caused by a race condition during rapid connection termination and asynchronous packet retransmission.\n\n## TL;DR\nUse-after-free in MSQuic leads to high-impact remote information disclosure of server memory.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00%\n- **Exploit Status**: No weaponized exploit available\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- .NET 10.0\n- .NET 9.0\n- .NET 8.0\n- Microsoft Visual Studio 2022\n- Microsoft Visual Studio 2026\n- **.NET 10.0**: >= 10.0.0, < 10.0.11 (Fixed in: `10.0.11`)\n- **.NET 9.0**: >= 9.0.0, < 9.0.19 (Fixed in: `9.0.19`)\n- **.NET 8.0**: >= 8.0.0, < 8.0.30 (Fixed in: `8.0.30`)\n- **Microsoft Visual Studio 2022**: >= 17.14.0, < 17.14.38 (Fixed in: `17.14.38`)\n- **Microsoft Visual Studio 2026**: >= 18.0, < 18.8.3 (Fixed in: `18.8.3`)\n\n## Mitigation\n\n- Apply security patches for .NET runtime and Visual Studio immediately.\n- Disable HTTP/3 (QUIC) and fall back to HTTP/2 (TCP) if immediate patching is not possible.\n\n**Remediation Steps:**\n1. Identify systems running vulnerable .NET runtime or Visual Studio versions.\n2. Deploy patched updates (10.0.11, 9.0.19, 8.0.30, etc.) across all development and production environments.\n3. Restart services hosting QUIC configurations to load the new msquic.dll module.\n\n## References\n\n- [Microsoft Security Response Center Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898)\n- [CVE-2026-62898 Authorization and Record](https://www.cve.org/CVERecord?id=CVE-2026-62898)\n- [Fix Commit in dotnet/runtime](https://github.com/dotnet/runtime/commit/6d9e1b3058c87cb4ba51e2b5f160e098819a5ad2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62898) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T03:31:19.471291Z"}