Act nowDisclosed

Advisory · CVE-2026-100219

Use-after-free in Microsoft QUIC allows unauthenticated network code execution

Microsoft's QUIC implementation has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code on Windows 11 and recent Windows Server releases. Microsoft rates it CVSS 3.1 9.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Microsoft QUIC
Identifier / CWE
CVE-2026-100219
CWE-416
Action timing
Immediate
ELI5

Explain it like I’m five

The QUIC stack keeps talking to memory it already freed, and a remote sender can arrange to be the one who fills that space.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Reach the component

    An unauthenticated attacker sends crafted network traffic to a Windows system running Microsoft QUIC.

  2. 02Memory flaw triggers

    The component mishandles the input and corrupts or reuses memory outside its intended bounds.

  3. 03Code runs

    The attacker gains code execution in the component's context on the target system.

What happened

Microsoft disclosed CVE-2026-100219 in its October 2026 update guide: a use-after-free weakness (CWE-416) in Microsoft QUIC lets an unauthorized attacker execute code over a network. The affected list covers recent Windows 11 releases and Windows Server 2022 and 2025.

Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Microsoft QUIC deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Microsoft QUIC while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for crashes in QUIC-serving processes, malformed QUIC traffic, and services restarting outside maintenance windows.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

QUIC underpins a growing share of HTTP/3 and application traffic. Treat this as a priority patch for any Windows host serving QUIC.