CVE-2026-85790
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Risk Assessment
A remote attacker could exploit freed memory to leak sensitive data, potentially compromising communication security.
Recommendation
Update Microsoft QUIC components to the latest version and limit exposure of QUIC services to untrusted networks.
Other vulnerabilities in Microsoft QUIC
See all- CVE-2026-105016Critical
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-100219Critical
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-62815Critical
A use-after-free vulnerability in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
- CVE-2026-103577High
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-62898High
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS