CVE-2026-85790 Microsoft QUIC Information Disclosure Vulnerability
An unauthorized attacker can disclose information over a network via a use-after-free flaw in Microsoft QUIC.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85790?
CVE-2026-85790 is a medium-severity use after free vulnerability in Microsoft Visual Studio 2022, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Weakness: CWE-416
Which versions are affected by CVE-2026-85790?
4 open source packages ship an affected version, including Microsoft.Native.Quic.MsQuic.Schannel. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.Native.Quic.MsQuic.Schannel NuGet | From 1.9.0 | 2.5.12 |
Microsoft.Native.Quic.MsQuic.Schannel NuGet | From 1.9.0 | 2.5.12 |
Microsoft.Native.Quic.MsQuic.Schannel NuGet | From 2.6.0 | 2.6.3 |
Microsoft.Native.Quic.MsQuic.Schannel NuGet | From 2.6.0 | 2.6.3 |
Products include Microsoft Native.quic.msquic.schannel, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft Windows 11 23h2, Microsoft Windows 11 24h2, Microsoft Windows 11 25h2 and 4 more.
How do I fix CVE-2026-85790?
Upgrade Microsoft.Native.Quic.MsQuic.Schannel to a fixed version for your release line: 2.5.12 or 2.6.3.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-85790 being exploited?
There is no known exploitation of CVE-2026-85790 in the wild and no public exploit code.
Sources
Also known as GHSA-2mxg-prvg-9jfg, UBUNTU-CVE-2026-85790.