CVE-2026-103577
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
Risk Assessment
The risk is the potential to bypass security features, potentially leading to unauthorized access to systems or data, compromising integrity and confidentiality.
Recommendation
It is recommended to apply relevant security updates for Microsoft QUIC and monitor vendor advisories.
Other vulnerabilities in Microsoft QUIC
See all- CVE-2026-105016Critical
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-100219Critical
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-62815Critical
A use-after-free vulnerability in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-85790Medium
A use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
- CVE-2026-62898High
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS