critical9.8
CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability
Impact
### Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. ### Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. #### Patches - Fix underflow in ACK frame parsing - 1e6e999b ### Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Microsoft.Native.Quic.MsQuic.OpenSSL | >= 2.5.0-ci.532574, < 2.5.7 | 2.5.7 |
| nuget | Microsoft.Native.Quic.MsQuic.Schannel | >= 2.5.0-ci.532574, < 2.5.7 | 2.5.7 |
| nuget | Microsoft.Native.Quic.MsQuic.Schannel | < 2.4.18 | 2.4.18 |
| nuget | Microsoft.Native.Quic.MsQuic.OpenSSL | < 2.4.18 | 2.4.18 |