CVE-2026-85790: CWE-416: Use After Free in Microsoft Microsoft Visual Studio 2022 version 17.14
Description
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVSS v3.1
Score 5.9medium
Affected software
Microsoft
Microsoft Visual Studio 2022 version 17.14
Microsoft
Microsoft Visual Studio 2026 version 18.10
Microsoft
Microsoft.Native.Quic.MsQuic.Schannel
Microsoft
Windows 11 version 23H2
Microsoft
Windows 11 Version 23H2
Microsoft
Windows 11 Version 24H2
Microsoft
Windows 11 Version 25H2
Microsoft
Windows 11 version 26H1
Microsoft
Windows 11 Version 26H2
Microsoft
Windows Server 2022
Microsoft
Windows Server 2025
Microsoft
Windows Server 2025 (Server Core installation)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a use-after-free flaw (CWE-416) in the Microsoft.Native.Quic.MsQuic.Schannel native binary dependency used by .NET projects and Visual Studio 2022 version 17.14. It allows an attacker to impact confidentiality (high impact on confidentiality) but does not affect integrity or availability. The issue is addressed by updating the affected package to version 2.6.2 or later and updating the .NET SDK/runtime. The vulnerability affects Windows platforms on all architectures. Microsoft provides official remediation guidance and patches, and Visual Studio prompts for updates to the .NET SDKs that include the fix.
Potential Impact
The vulnerability impacts confidentiality, potentially allowing unauthorized disclosure of information. There is no impact on integrity or availability. The CVSS score is 5.9 (medium severity), indicating a moderate risk. The vulnerability affects Windows platforms and all architectures where the affected package is used.
Mitigation Recommendations
An official fix is available. Users should update the Microsoft.Native.Quic.MsQuic.Schannel package to version 2.6.2 or later. Additionally, updating to the latest .NET SDK and runtime versions via Visual Studio or manual installation will remediate the vulnerability. Self-contained applications targeting affected versions must be recompiled and redeployed. Restart applications after updating to ensure the fix takes effect.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- microsoft
- Date Reserved
- 2026-09-04T18:08:54.992Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
- Vendor Advisory Urls
- [{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85790","vendor":"Microsoft"}]
Threat ID: 6ace85392cdf04f6569fe83e
Added to database: 10/13/2026, 19:23:37 UTC
Last enriched: 10/13/2026, 21:58:05 UTC
Last updated: 10/13/2026, 22:50:43 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.