CVE-2026-105016
Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in Microsoft QUIC

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-105016
EUVD
EUVD-2026-100459

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
Microsoft .NET 10.0 10.0.0
Microsoft .NET 11.0 11.0.0
Microsoft .NET 8.0 8.0.0
Microsoft .NET 9.0 9.0.0
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0
Microsoft Microsoft Visual Studio 2026 version 18.10 18.10.0
Microsoft Windows 11 version 23H2 10.0.22631.0
Microsoft Windows 11 Version 23H2 10.0.22631.0
Microsoft Windows 11 Version 24H2 10.0.26100.0
Microsoft Windows 11 Version 25H2 10.0.26200.0
Microsoft Windows 11 version 26H1 10.0.28000.0
Microsoft Windows 11 Version 26H2 10.0.26300.0
Microsoft Windows Server 2022 10.0.20348.0
Microsoft Windows Server 2025 10.0.26100.0
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in Microsoft QUIC, a protocol for internet communication. It allows an unauthorized attacker to execute arbitrary code over a network by exploiting memory corruption in the heap region.

Impact Analysis

An attacker could exploit this to run malicious code on your system remotely without authentication. This could lead to data theft, system compromise, or further network attacks if you use affected Microsoft products like Windows or .NET.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy). Organizations may face fines or legal consequences if they fail to patch systems promptly.

Mitigation Strategies

Apply the latest security updates from Microsoft for QUIC and related components. Monitor Microsoft's update guide for patches and disable QUIC if not required until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart