CVE-2026-105794Critical· 9.1▾ MidnightMsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.0%
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.20Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0, < 2.5.11Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.6.0, < 2.6.1Patched in:
Microsoft.Native.Quic.MsQuic.OpenSSL 2.4.20Microsoft.Native.Quic.MsQuic.OpenSSL 2.5.11Microsoft.Native.Quic.MsQuic.OpenSSL 2.6.1Connected by shared product, vendor, weakness, or advisory.
GHSA-2q33-cf8w-7q23Critical· 9.8Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability
CVE-2020-1113Medium· 5.3A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC
GHSA-p3jp-9v83-76w9High· 8.1Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
CVE-2026-62765High· 7.5Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-83831High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-85898High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability