CVE-2026-62898: Microsoft QUIC Information Disclosure Vulnerability

Overview

Severity

High (CVSS 7.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Aug

Released

2026-08-11

Last Updated

2026-08-13

EPSS Score

1.03% (percentile: 62.2%)

Description

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

FAQ

What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read portions of process memory.

Affected Products (5)

Developer Tools

• .NET 10.0 installed on Windows
• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.8
• .NET 9.0 installed on Windows
• .NET 8.0 installed on Windows

Security Updates (3)

• 5122106
• 5122105
• 5122104

Acknowledgments

Quac Tran

Revision History

• 2026-08-11: Information published.
• 2026-08-13: Removed Linux and macOS products from the Affected Software table. This is an informational change only.