GitHub Advisoryadvisory · NuGet

GHSA-gvvw-8j96-8g5r MsQuic has a Remote Elevation of Privilege Vulnerability

CRITICAL Published 2026-04-16 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-32179
Ecosystem
NuGet
Packages
Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-191
Reviewed
2026-04-16

Affected packages

• NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: >= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: >= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7 • NuGet Microsoft.Native.Quic.MsQuic.Schannel: < 2.4.18 → fixed in 2.4.18 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: < 2.4.18 → fixed in 2.4.18

Description

Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. Patches • Fix underflow in ACK frame parsing - 1e6e999b Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-191 Integer Underflow (Wrap or Wraparound) weakness

References