Vulnerability Analysis

CVE-2026-62815: Microsoft QUIC Use-After-Free Remote Code Execution — No Auth Required

Executive Summary

CVE-2026-62815 is a Critical (CVSS 9.8) use-after-free remote code execution vulnerability in Microsoft's QUIC implementation (MsQuic), disclosed as part of August 2026 Patch Tuesday. An unauthenticated attacker can exploit it by sending a single malformed UDP/QUIC packet to any Windows system with QUIC traffic exposed, with no user interaction and low attack complexity. Every Windows Server 2022/2025 instance and modern Windows 11 system running HTTP/3-capable services is at risk until the August 11, 2026 cumulative update is applied.

1. What Is This Vulnerability?

Background: Microsoft QUIC (MsQuic)

QUIC is a modern, UDP-based transport protocol that underpins HTTP/3. Microsoft ships its own open-source implementation — MsQuic (msquic.dll) — baked into Windows since Windows 11 and Windows Server 2022. It powers IIS HTTP/3 support, .NET Kestrel, and various internal Windows networking components.

The Flaw: Use-After-Free in Connection Handling

The vulnerability (CWE-416) lives in how the MsQuic stack manages memory during QUIC connection lifecycle processing. Specifically:

  • During a QUIC handshake or active data transfer, the implementation frees a connection-state object prematurely.
  • A reference to that freed memory region is retained by another part of the QUIC processing loop.
  • When the dangling pointer is subsequently dereferenced (triggered by an incoming QUIC packet), the attacker gains controlled write to a freed memory region.

In use-after-free exploitation, the attacker wins by:

  1. Triggering the free of the target object via a crafted initial or mid-connection packet.
  2. Heap-grooming: sending additional packets that cause the allocator to reclaim the freed region with attacker-controlled data.
  3. Sending the trigger packet that causes the stale pointer to be dereferenced — now pointing to attacker-owned memory.
  4. Redirecting execution to shellcode or a ROP chain.

Because QUIC is stateless at the handshake initiation level (no TCP three-way handshake), the attacker does not need to complete a connection — they only need the target host to respond to a UDP packet on port 443.

Attack Vector

Attacker (Internet/LAN)
     |
     |  UDP port 443 — crafted QUIC Initial packet
     v
Windows Server / Windows 11 host
     |
     |  msquic.dll processes malformed QUIC frame
     |  -> frees connection object
     |  -> retains dangling pointer
     |  -> follow-up packet triggers UAF
     v
  RCE as SYSTEM / service account

The CVSS vector — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — reflects that no privileges, no user interaction, and no special conditions are needed.

Real-World Impact

No confirmed in-the-wild exploitation has been reported as of the August 2026 Patch Tuesday disclosure. However, the combination of:

  • CVSS 9.8 with network-reachable, zero-auth, zero-click characteristics
  • QUIC exposed by default on IIS in Windows Server 2025
  • A well-understood vulnerability class (UAF) with existing public exploitation frameworks

...makes weaponization a matter of time, not capability. Comparable QUIC-layer bugs in other implementations (e.g., OpenSSL, ngtcp2) have seen PoC code published within days of disclosure.

2. Who Is Affected?

Product Affected Versions
Windows 11 23H2, 24H2, 25H2, 26H1
Windows Server 2022 All editions (including Server Core)
Windows Server 2025 All editions (including Server Core)

You are at higher risk if:

  • You run IIS with HTTP/3 enabled (default-on in Windows Server 2025 IIS)
  • You host .NET/ASP.NET Kestrel applications — Kestrel uses MsQuic for HTTP/3
  • You have UDP port 443 open inbound from the internet or an untrusted network
  • You have not applied the August 11, 2026 cumulative update (KB5063060 for WS2025, KB5063061 for WS2022)

Not affected:

  • Windows 10 (MsQuic is not natively integrated)
  • Linux/macOS systems
  • Systems where UDP 443 is blocked at the network perimeter
  • Systems where HTTP/3 / QUIC is explicitly disabled

3. How to Detect It (Testing)

Manual Testing Steps

Step 1: Identify QUIC-exposed services

On each target Windows host:

# Check for QUIC (UDP 443) listeners
netstat -ano | findstr "UDP" | findstr ":443"

Map the PID to a process:

Get-Process -Id <PID>

Look for w3wp.exe (IIS), dotnet.exe, or svchost.exe — these indicate QUIC-capable services.

Step 2: Check IIS HTTP/3 configuration

Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
  -filter "system.webServer/serverRuntime" -name "enabled"

# Also inspect Alt-Svc headers
Invoke-WebRequest -Uri "https://localhost/" -UseBasicParsing | `
  Select-Object -ExpandProperty Headers | Where-Object { $_ -like "*alt-svc*" }

An alt-svc: h3=":443" header confirms HTTP/3/QUIC is advertised.

Step 3: Verify patch status

# Check installed KBs
Get-HotFix | Where-Object { $_.HotFixID -in @("KB5063060","KB5063061","KB5062553") }

# Or check build number — patched WS2025 is build 26100.4351+
[System.Environment]::OSVersion.Version
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuild

If the relevant KB is missing, the system is vulnerable.

Automated Scanning

Option A: Nessus / Tenable

  • Plugin ID for CVE-2026-62815 (check Tenable plugin feed for the latest)
  • Run a credentialed scan targeting Windows Server hosts
  • Filter results by CVE-2026-62815

Option B: Nmap — confirm QUIC is exposed

# Confirm UDP 443 is open (QUIC listener)
nmap -sU -p 443 --script quic-info <target-ip>

If the port responds with a QUIC version negotiation packet, the service is listening. Cross-reference with patch status to assess exposure.

Option C: Nuclei

id: CVE-2026-62815-quic-exposed
info:
  name: Microsoft QUIC RCE - QUIC Endpoint Exposure Check
  severity: critical
  cve-id: CVE-2026-62815

network:
  - host:
      - "{{Hostname}}:443"
    protocol: udp
    inputs:
      - data: "{{ hex_decode('c0000000010000000000000000005 ...initial_quic_packet...') }}"
    matchers:
      - type: word
        words:
          - "version_negotiation"
        condition: and

(Full PoC packet structure pending public disclosure — monitor Nuclei template feed)

Code Review Checklist

If you maintain custom code that embeds msquic.dll or uses the MsQuic NuGet package:

  • Confirm Microsoft.Native.Quic.MsQuic.Schannel package version ≥ patched version
  • Audit any custom connection lifecycle hooks that call MsQuic::ConnectionClose or StreamClose APIs for races between free and use
  • Verify that third-party QUIC wrappers in your dependencies pin a patched MsQuic version

4. How to Fix It (Mitigation)

Step-by-Step Remediation

Primary fix: Apply the August 2026 cumulative update

  1. Open Windows Update → Check for updates → Install all pending updates.
  2. Or deploy via WSUS/Intune/SCCM — target KB article:
    • Windows Server 2025: KB5063060
    • Windows Server 2022: KB5063061
    • Windows 11 26H1: KB5062553
  3. Reboot after installation.
  4. Verify: re-run the patch check command above and confirm the build number advanced.

Interim mitigation (if patching is not immediately possible):

Option A: Block QUIC at the firewall

Block inbound UDP traffic on port 443 at the network perimeter or host-based firewall. This prevents exploitation from remote attackers, but disables HTTP/3 for affected services.

# Host-based firewall rule (Windows Firewall)
New-NetFirewallRule -DisplayName "Block QUIC UDP 443 Inbound" `
  -Direction Inbound `
  -Protocol UDP `
  -LocalPort 443 `
  -Action Block `
  -Profile Any

Option B: Disable HTTP/3 in IIS

<!-- In applicationHost.config or web.config -->
<system.webServer>
  <serverRuntime enableHttp3="false" />
</system.webServer>

Or via PowerShell:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' `
  -filter "system.webServer/serverRuntime" `
  -name "enableHttp3" -value "False"
iisreset

Option C: Disable HTTP/3 in .NET/Kestrel

In appsettings.json or Program.cs:

{
  "Kestrel": {
    "EndpointDefaults": {
      "Protocols": "Http1AndHttp2"
    }
  }
}

Or in code:

// Program.cs — remove Http3 from protocol list
builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(443, listenOptions =>
    {
        listenOptions.Protocols = HttpProtocols.Http1AndHttp2; // Remove Http3
        listenOptions.UseHttps();
    });
});

Configuration Hardening

Even after patching, harden the QUIC surface:

# Restrict QUIC to known source IPs (if client IPs are predictable)
New-NetFirewallRule -DisplayName "Allow QUIC from Trusted Range" `
  -Direction Inbound -Protocol UDP -LocalPort 443 `
  -RemoteAddress 10.0.0.0/8 -Action Allow

New-NetFirewallRule -DisplayName "Block QUIC from All Others" `
  -Direction Inbound -Protocol UDP -LocalPort 443 `
  -Action Block -Profile Any

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A: Apply patch, attempt QUIC connection from a test client — verify HTTP/3 still functions normally (no regression in legitimate use).
  • Scenario B: From an external test host, send a malformed QUIC Initial packet (using a fuzzing tool like quic-go in adversarial mode) — verify the server does not crash or return unexpected memory contents.
  • Scenario C: Confirm that the interim firewall block (if applied) causes QUIC clients to fall back to HTTP/1.1 or HTTP/2 gracefully, with no application-level errors.

Security Test Cases

Test Case 1: Verify patch is applied

  • Precondition: Apply KB5063060 / KB5063061 and reboot
  • Steps: Run Get-HotFix and check build number
  • Expected Result: KB present, build number ≥ patched threshold

Test Case 2: Confirm QUIC endpoint behavior post-patch

  • Precondition: Patched system with HTTP/3 enabled
  • Steps: Use curl --http3 https://<target>/ from a test client
  • Expected Result: HTTP/3 connection succeeds (no crash), server process remains stable

Test Case 3: Validate firewall interim mitigation

  • Precondition: Firewall rule blocking UDP 443 applied
  • Steps: nmap -sU -p 443 <target> from external host
  • Expected Result: Port reported as filtered, no QUIC version negotiation response

Automated Tests

# Quick patch validation script
import subprocess, re, sys

def check_kb_installed(kb_id):
    result = subprocess.run(
        ["powershell", "-Command", f"Get-HotFix | Where-Object {{ $_.HotFixID -eq '{kb_id}' }}"],
        capture_output=True, text=True
    )
    return kb_id in result.stdout

target_kb = "KB5063060"  # Windows Server 2025 — update per OS version
if check_kb_installed(target_kb):
    print(f"[PASS] {target_kb} is installed. CVE-2026-62815 is patched.")
    sys.exit(0)
else:
    print(f"[FAIL] {target_kb} NOT found. System may be vulnerable to CVE-2026-62815!")
    sys.exit(1)

6. Prevention & Hardening

Best Practices

  • Patch cadence: Treat Patch Tuesday cumulative updates as P1 for internet-facing Windows servers. August 2026 included a CVSS 9.8 RCE — this class of update should reach production within 72 hours.
  • Network segmentation: Windows servers should not have UDP 443 exposed to the internet unless specifically required. Place HTTPS/HTTP/3 services behind a reverse proxy or WAF that terminates QUIC and proxies HTTP/1.1 or HTTP/2 internally.
  • Disable unused protocols: If you do not require HTTP/3, disable it at the application layer (IIS, Kestrel). Reducing protocol surface is one of the most reliable long-term mitigations for transport-layer vulnerabilities.
  • Supply chain awareness: If you use NuGet packages that embed MsQuic (e.g., Microsoft.Native.Quic.MsQuic.Schannel), audit your dependency tree and keep these packages current alongside OS patches.

Monitoring & Detection

Set up detection for pre-patch exploitation attempts:

Windows Event Log / Sysmon

<!-- Sysmon config: detect unexpected crashes in w3wp.exe, dotnet.exe -->
<RuleGroup name="QUIC UAF Crash Detection" groupRelation="or">
  <ProcessTerminate onmatch="include">
    <Image condition="contains">w3wp.exe</Image>
    <Image condition="contains">dotnet.exe</Image>
  </ProcessTerminate>
</RuleGroup>

Process crashes in IIS worker processes or .NET hosts, especially during connection-burst periods, can be an early indicator of exploitation attempts.

Network-Level Detection (Zeek/Suricata)

# Suricata rule — alert on QUIC Initial packets with anomalous frame structures
alert udp any any -> $HOME_NET 443 (
  msg:"Possible CVE-2026-62815 Exploit Attempt - Malformed QUIC Initial";
  content:"|c0|"; offset:0; depth:1;
  content:"|00 00 00 01|"; within:5;
  pcre:"/\xc0[\x00-\xff]{4}[\x00]{3}[\x01]/";
  threshold: type limit, track by_src, count 5, seconds 10;
  classtype:attempted-admin;
  sid:9999815; rev:1;
)

(Refine signature once PoC packet structure is publicly available)

Azure Monitor / Microsoft Defender for Cloud

If running on Azure, enable Microsoft Defender for Servers — it will surface CVE-2026-62815 in the vulnerability assessment blade and generate an alert if patch status is non-compliant.

References

Latest from the blog

See all →