PatchaPalooza

CVE-2024-26190: Microsoft QUIC Denial of Service Vulnerability

CVE-2024-26190 is a denial of service vulnerability in Microsoft QUIC, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.99% probability of exploitation activity in the next 30 days, higher than 87% of all scored vulnerabilities. Microsoft released the fix on 12 March 2024 in the March 2024 Patch Tuesday, delivered through 7 security updates (KB5035857, KB5035959, KB5035854, KB5035853 and more). It affects 17 products in 2 product families (Developer Tools, Windows).

Key facts

CVE ID
CVE-2024-26190
Severity
High CVSS 7.5
Microsoft severity
Important
Impact
Denial of Service
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-400
EPSS
2.99% (percentile 87%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
March 2024 Patch Tuesday
Product families
Developer Tools, Windows

CVSS score and vector

Microsoft scores CVE-2024-26190 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Affected products (17)

Developer Tools

ProductSecurity updateTypeFixed buildRestart
Microsoft Visual Studio 2022 version 17.9Release NotesSecurity Update17.9.3Maybe
PowerShell 7.3Release NotesSecurity Update7.3.12Maybe
PowerShell 7.4
Microsoft Visual Studio 2022 version 17.4Release NotesSecurity Update17.4.17Maybe
Microsoft Visual Studio 2022 version 17.6Release NotesSecurity Update17.6.13Maybe
Microsoft Visual Studio 2022 version 17.8Release NotesSecurity Update17.8.8Maybe
.NET 7.0KB5036451Monthly Rollup7.0.17Maybe
.NET 8.0KB5036452Security Update8.0.3Maybe

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2022KB5035857
KB5035959		Security Update
SecurityHotpatchUpdate		10.0.20348.2340
10.0.20348.2333		Yes
Yes
Windows Server 2022 (Server Core installation)KB5035857
KB5035959		Security Update
SecurityHotpatchUpdate		10.0.20348.2340
10.0.20348.2333		Yes
Yes
Windows 11 version 21H2 for x64-based SystemsKB5035854Security Update10.0.22000.2836Yes
Windows 11 version 21H2 for ARM64-based SystemsKB5035854Security Update10.0.22000.2836Yes
Windows 11 Version 22H2 for ARM64-based SystemsKB5035853Security Update10.0.22621.3296Yes
Windows 11 Version 22H2 for x64-based SystemsKB5035853Security Update10.0.22621.3296Yes
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)KB5035856Security Update10.0.25398.763Yes

Security updates (7)

NIST NVD data

NVD status
Analyzed
NVD CVSS
7.5 (HIGH)
NVD weakness
CWE-400
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
.netfrom 7.0.0, before 7.0.17
.netfrom 8.0.0, before 8.0.3
powershellfrom 7.3, before 7.3.12
powershellfrom 7.4, before 7.4.2
visual studio 2022from 17.4.0, before 17.4.17
visual studio 2022from 17.6.0, before 17.6.13
visual studio 2022from 17.8.0, before 17.8.8
visual studio 2022from 17.9.0, before 17.9.3
windows 11 21h2before 10.0.22000.2836
windows 11 22h2before 10.0.22621.3296
windows 11 23h2before 10.0.22631.3296
windows server 2022before 10.0.20348.2340
windows server 2022 23h2before 10.0.25398.763

References

Revision history

VersionDateDescription
1.0Information published.
2.0Revised the Security Updates table to include PowerShell 7.3 and PowerShell 7.4 because these versions of PowerShell 7 are affected by this vulnerability. See https://github.com/PowerShell/Announcements/issues/73 for more information.

Sources