Key points
- CVE-2026-105016 is rated critical with a CVSS score of 9.8.
- The flaw affects .NET 8, 9, 10, and 11 RC2 on Windows systems.
- A patched version of the Microsoft.Native.Quic.MsQuic.Schannel package is available.
Windows applications using Microsoft .NET versions 8.0, 9.0, 10.0, and 11 RC2 are exposed to a critical remote code execution vulnerability. The flaw, identified as CVE-2026-105016, exists in the Microsoft QUIC implementation. Attackers can exploit this issue over a network without needing authentication or user interaction.
In plain English
The vulnerability is a heap-based buffer overflow. An attacker can send a specially crafted IPv6 QUIC packet to a vulnerable system. This packet triggers the overflow in the HTTP/3 path. As a result, the attacker can run arbitrary code on the target machine. This happens remotely and without the user doing anything.
The background
Microsoft released a security advisory detailing the issue. The National Vulnerability Database assigns the flaw a CVSS 3.1 score of 9.8, classifying it as critical. The weakness type is CWE-122. The advisory notes that the flaw affects all Windows architectures. It specifically impacts projects using the Microsoft.Native.Quic.MsQuic.Schannel package.
What changes now
Developers must update their applications to remove the vulnerability. The affected package version is 2.5.11-ci.156755675. The patched version is 2.5.11-ci.159417053. Users should install the latest servicing update for their supported .NET release. If Visual Studio is used, updating it will also update the .NET SDKs.
Who needs to act first
Teams usually prioritize systems exposed to the internet. Check whether public-facing services use affected .NET versions. Update these systems first to reduce immediate risk. Test the update in a non-production environment before rolling it out widely. Back up current configurations to ensure a quick rollback if issues arise. Monitor logs for unusual activity during the transition.
What to do and how to stay safe: Microsoft
- Scan your inventory for applications using the Microsoft.Native.Quic.MsQuic.Schannel package version 2.5.11-ci.156755675.
- Update the package reference to version 2.5.11-ci.159417053 or later in your project files.
- Install the latest servicing updates for all supported .NET releases on your Windows servers.
- Verify that Visual Studio installations are updated to ensure SDKs are current.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which .NET versions are affected by CVE-2026-105016?
The vulnerability affects .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows.
Is there a fix available for this vulnerability?
Yes, Microsoft has released a patched version of the affected package and servicing updates.
What is the CVSS score for this flaw?
The National Vulnerability Database rates CVE-2026-105016 as critical with a score of 9.8.
