59/59 sources · synced 00:50 UTC Customize Public mode
CVE-2026-62898ImportantRevised 13 Aug

Microsoft QUIC Information Disclosure Vulnerability

MSRC advisory NVD CVE.org

Assessment

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Severity
Important
CVSS base score
7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Impact
Information Disclosure
EPSS, next 30 days
1.0%Higher than 62.2% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability
Exploitation Less Likely
Publicly disclosed
No
Customer action
Required: apply the update
Component
Microsoft QUIC
Weakness
CWE-416: Use After Free
Issued by
Microsoft
Published
11 Aug 2026 · August 2026
Last revised
13 Aug 2026Removed Linux and macOS products from the Affected Software table. This is an informational change only.

Updates that fix it

3 KBs
KBTypeRestartApplies toOther CVEs
KB5122104 Security Update — .NET 8.0 installed on Windows All CVEs in KB5122104
KB5122105 Security Update — .NET 9.0 installed on Windows All CVEs in KB5122105
KB5122106 Security Update — .NET 10.0 installed on Windows All CVEs in KB5122106

Affected products

Developer Tools
5 affected products
  • .NET 10.0 installed on Windows
  • .NET 8.0 installed on Windows
  • .NET 9.0 installed on Windows
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.8
ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft. Microsoft, Windows, Microsoft 365, Azure, and related names are trademarks of the Microsoft group of companies. Data comes from public sources listed on Sources; every item links to its original page. Dates and statuses can change after they are read. Built by Evotec. This is the public demo. It can also run on your own server, with your Microsoft 365 tenant and device data kept inside your network; Evotec can help you deploy and extend it.