CVE-2026-62815: Microsoft QUIC Use After Free Vulnerability

CVE-2026-62815 Overview

CVE-2026-62815 is a use-after-free vulnerability in Microsoft QUIC that allows an unauthorized attacker to execute code over a network. QUIC is the transport protocol underlying HTTP/3 and several Microsoft server workloads, including IIS and SMB over QUIC. The flaw is tracked under CWE-416: Use After Free and requires no authentication or user interaction to exploit. Successful exploitation grants full compromise of confidentiality, integrity, and availability on the target system. Microsoft published details in the Microsoft Security Update CVE-2026-62815 advisory.

Critical Impact
Remote, unauthenticated code execution against any network-reachable service that terminates Microsoft QUIC traffic.

Affected Products

Microsoft QUIC (MsQuic) library
Windows services and roles built on the Microsoft QUIC stack
Applications that link against the affected msquic implementation

Discovery Timeline

2026-08-11 - CVE-2026-62815 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62815

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Microsoft QUIC transport implementation. QUIC is a UDP-based transport that multiplexes streams, manages connection state, and negotiates cryptographic material inside a single protocol. An attacker who can send crafted QUIC datagrams to a listening endpoint can trigger the reuse of memory that has already been freed by the connection state machine. Because QUIC processing occurs before any application-layer authentication, the attack surface is fully pre-auth. Reachability requires only UDP access to the target port, most commonly UDP/443 for HTTP/3 or UDP/443 for SMB over QUIC.

Root Cause

The root cause is improper lifetime management of a QUIC protocol object. A code path frees a structure while another path retains and later dereferences the same pointer. When the freed allocation is replaced with attacker-controlled data, subsequent dereference operations lead to controlled memory reads, writes, or indirect calls. Microsoft has not published low-level details in the advisory, so the exact object and code path are not publicly disclosed.

Attack Vector

Exploitation occurs remotely over the network with low attack complexity. The attacker sends specifically ordered or malformed QUIC packets, such as handshake frames, stream frames, or connection-close messages, that induce the vulnerable free-then-use sequence. No user interaction is required. Given the network-facing nature of QUIC listeners and the EPSS probability of 0.936%, defenders should treat internet-exposed QUIC endpoints as priority assets for patching.

No public proof-of-concept has been observed. See the Microsoft Security Update CVE-2026-62815 advisory for authoritative technical guidance.

Detection Methods for CVE-2026-62815

Indicators of Compromise

Unexpected crashes, restarts, or access violations in processes that load msquic.dll or the equivalent Linux libmsquic module.
Anomalous UDP/443 traffic patterns, including malformed QUIC Initial packets or high volumes of short-lived connections from a single source.
New child processes or outbound connections spawned from services that terminate QUIC, such as IIS worker processes or SMB server components.

Detection Strategies

Monitor Windows Error Reporting and application crash telemetry for repeated faults in QUIC-linked binaries.
Deploy IDS or NDR signatures for oversized or malformed QUIC frames targeting servers that expose HTTP/3 or SMB over QUIC.
Correlate process behavior with network telemetry to flag QUIC-terminating services that execute unexpected commands or load unusual modules.

Monitoring Recommendations

Baseline legitimate QUIC clients and versions to surface deviations in ALPN, version negotiation, or transport parameters.
Enable verbose logging on the QUIC provider via logman or ETW to capture connection state transitions during triage.
Review firewall and load-balancer logs for scanning of UDP/443 across the perimeter estate.

How to Mitigate CVE-2026-62815

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all systems running Microsoft QUIC.
Inventory workloads that link msquic, including IIS with HTTP/3, SMB over QUIC servers, and third-party applications bundling MsQuic.
Restrict inbound UDP/443 at the perimeter to only hosts that must serve QUIC traffic.

Patch Information

Microsoft has released fixed builds of the MsQuic library and dependent Windows components. Refer to the Microsoft Security Update CVE-2026-62815 advisory for the specific KB articles, package versions, and applicability matrix for supported Windows releases and standalone MsQuic distributions.

Workarounds

Disable HTTP/3 on IIS and reverse proxies until patches are deployed, forcing clients to fall back to HTTP/2 over TCP.
Disable SMB over QUIC on file servers where it is not required and rely on SMB over TCP with equivalent protections.
Block inbound UDP/443 at network boundaries where QUIC services are not intentionally published.

bash

# Disable HTTP/3 (QUIC) globally on Windows Server via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters" /v EnableHttp3 /t REG_DWORD /d 0 /f

# Restart the HTTP service to apply
net stop http /y && net start http

# Optional: block inbound QUIC at the host firewall
netsh advfirewall firewall add rule name="Block Inbound QUIC UDP 443" dir=in action=block protocol=UDP localport=443