CVE-2026-62898 - Vulnerability Details - OpenCVE

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft	.net Visual Studio 2022 Visual Studio 2026

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898

History

Tue, 11 Aug 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Title		Microsoft QUIC Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft .net Microsoft visual Studio 2022 Microsoft visual Studio 2026
Weaknesses		CWE-416
CPEs		cpe:2.3:a:microsoft:.net:::::::: cpe:2.3:a:microsoft:visual_studio_2022:::::::: cpe:2.3:a:microsoft:visual_studio_2026::::::::
Vendors & Products		Microsoft Microsoft .net Microsoft visual Studio 2022 Microsoft visual Studio 2026
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-08-11T17:07:16.953Z

Updated: 2026-08-12T00:01:22.344Z

Reserved: 2026-07-14T21:25:21.035Z

Link: CVE-2026-62898

Vulnrichment

Updated: 2026-08-11T17:47:42.798Z

NVD

Status : Awaiting Analysis

Published: 2026-08-11T17:18:43.993

Modified: 2026-08-11T18:53:42.910

Link: CVE-2026-62898

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62898", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-07-14T21:25:21.035Z", "datePublished": "2026-08-11T17:07:16.953Z", "dateUpdated": "2026-08-12T00:01:22.344Z"}, "containers": {"cna": {"title": "Microsoft QUIC Information Disclosure Vulnerability", "datePublic": "2026-08-11T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.14.0", "versionEndExcluding": "17.14.38"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.0", "versionEndExcluding": "18.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.30"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0", "versions": [{"version": "10.0.0", "lessThan": "10.0.11", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"version": "8.0.0", "lessThan": "8.0.30", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"version": "9.0.0", "lessThan": "9.0.19", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"version": "17.14.0", "lessThan": "17.14.38", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.8", "versions": [{"version": "18.0", "lessThan": "18.8.3", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-416: Use After Free", "lang": "en-US", "type": "CWE", "cweId": "CWE-416"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-12T00:01:22.344Z"}, "references": [{"name": "Microsoft QUIC Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T17:47:31.814853Z", "id": "CVE-2026-62898", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:47:51.516Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:47:31.814853Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:47:42.798Z"}}], "cna": {"title": "Microsoft QUIC Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.11", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.30", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.19", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"status": "affected", "version": "17.14.0", "lessThan": "17.14.38", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.8", "versions": [{"status": "affected", "version": "18.0", "lessThan": "18.8.3", "versionType": "custom"}]}], "datePublic": "2026-08-11T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898", "name": "Microsoft QUIC Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.11", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.14.38", "versionStartIncluding": "17.14.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "18.8.3", "versionStartIncluding": "18.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.19", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.30", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-12T00:01:22.344Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62898", "state": "PUBLISHED", "dateUpdated": "2026-08-12T00:01:22.344Z", "dateReserved": "2026-07-14T21:25:21.035Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-08-11T17:07:16.953Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": ".NET 10.0", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.11", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.30", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.19", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2022 version 17.14", "vendor": "Microsoft", "versions": [{"lessThan": "17.14.38", "status": "affected", "version": "17.14.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2026 version 18.8", "vendor": "Microsoft", "versions": [{"lessThan": "18.8.3", "status": "affected", "version": "18.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network."}], "id": "CVE-2026-62898", "lastModified": "2026-08-11T18:53:42.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62898", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T17:47:31.814853Z", "version": "2.0.3"}}]}, "published": "2026-08-11T17:18:43.993", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62898"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "secure@microsoft.com", "type": "Secondary"}]}