CVE-2026-105016: CWE-122: Heap-based Buffer Overflow in Microsoft .NET 10.0

This vulnerability (CVE-2026-105016) is a heap-based buffer overflow (CWE-122) in Microsoft QUIC implementation used by .NET on Windows platforms. It allows remote code execution triggered by a specially crafted IPv6 QUIC packet reaching the HTTP/3 path without authentication or user interaction. The affected package is Microsoft.Native.Quic.MsQuic.Schannel versions >=2.5.11-ci.156755675 and <=2.5.11-ci.156755675. Microsoft has provided an official fix in version 2.5.11-ci.159417053 and servicing updates for .NET releases. Applications using affected package versions or self-contained deployments must update and restart to mitigate the vulnerability.

The vulnerability enables unauthenticated remote attackers to execute arbitrary code on affected systems by sending a crafted IPv6 QUIC packet. This can lead to full compromise of the affected application or system. The CVSS 3.1 score is 9.8 (Critical), reflecting high impact on confidentiality, integrity, and availability.

An official fix is available. Users should install the latest servicing updates for their supported .NET releases. If directly referencing Microsoft.Native.Quic.MsQuic.Schannel, update to version 2.5.11-ci.159417053 or later. Self-contained applications targeting affected versions must be recompiled and redeployed. After updating, restart affected applications to apply the fix.