Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-105016

Fixed upstream EPSS 2%CVSS 9.8

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Published 2026-10-13 · CVE record · OSV

Products: Microsoft .NET 10.0 runtime, Microsoft .NET 11.0 runtime, Microsoft .NET 8.0 runtime, Microsoft .NET 9.0 runtime, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)

Fixed upstream

EcosystemPackageFixed in
NuGetMicrosoft.Native.Quic.MsQuic.Schannel2.5.11-ci.159417053

Distro releases

ReleasePackageFixed in
Ubuntu 22.04 LTSdotnet7no fix