MsQuic has a Remote Elevation of Privilege Vulnerability

CRITICAL 9.8CVE-2026-32179 · GHSA-gvvw-8j96-8g5r · Published 16/04/2026 · updated 08/05/2026

In short

CVE-2026-32179 is a CRITICAL (CVSS 9.8) vulnerability affecting Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel.
Fix: update to 2.5.7, 2.4.18 or later.

Package	Affected versions	Patched versions
Microsoft.Native.Quic.MsQuic.OpenSSL NuGet	`≥ 2.5.0-ci.532574, < 2.5.7< 2.4.18`	`2.5.72.4.18`
Microsoft.Native.Quic.MsQuic.Schannel NuGet	`≥ 2.5.0-ci.532574, < 2.5.7< 2.4.18`	`2.5.72.4.18`

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

NuGet

≥ 2.5.0-ci.532574, < 2.5.7< 2.4.18

2.5.72.4.18

NuGet

≥ 2.5.0-ci.532574, < 2.5.7< 2.4.18

2.5.72.4.18

Description

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

An attacker who successfully exploited this vulnerability could gain elevated privileges.

More vulnerabilities in Microsoft.Native.Quic.MsQuic.OpenSSL

See all →