Threats tagged 'ghsa-gvvw-8j96-8g5r'

Microsoft.Native.Quic.MsQuic.OpenSSL contains a critical remote elevation of privilege vulnerability (CVE-2026-32179) due to improper input validation causing an integer underflow when decoding ACK frames. This flaw allows an attacker to gain elevated privileges over a network. The issue affects versions prior to 2.4.18 and versions from 2.5.0-ci.532574 up to but not including 2.5.7. A patch fixing the underflow in ACK frame parsing is available in versions 2.4.18 and 2.5.7.