CVE-2026-85790 · GHSA-2mxg-prvg-9jfg

Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability

What to know

What it is: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Affected: Microsoft.Native.Quic.MsQuic.Schannel (nuget) >= 1.9.0, < 2.5.12; Microsoft.Native.Quic.MsQuic.Schannel (nuget) >= 2.6.0, < 2.6.3
Fix: Upgrade Microsoft.Native.Quic.MsQuic.Schannel to 2.5.12 or 2.6.3 (whichever matches your release line) or later.
Exploitation: No known exploitation

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

Microsoft Windows 11 23h2: Red, act today. Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVE-2026-85790: Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability (CVSS 5.9 · EPSS 1%)
CVE-2026-100219: Use-after-free (CVSS 9.8 · EPSS 1%)
CVE-2026-96909: Heap buffer overflow (CVSS 9.8 · EPSS 1%)
CVE-2026-85818: Improper verification of cryptographic signature in Windows Schannel allows an unauthorized… (CVSS 9.0 · EPSS 0%)

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Microsoft Windows 11 23h2

Same weakness: Use-after-free (CWE-416). 399 other warnings in 30 days
Same product: Earlier Microsoft.Native.Quic.MsQuic.Schannel warnings. 31 in the last 90 days

Package	Ecosystem	Vulnerable	Fixed in
Microsoft.Native.Quic.MsQuic.Schannel	nuget	>= 1.9.0, < 2.5.12	2.5.12
Microsoft.Native.Quic.MsQuic.Schannel	nuget	>= 2.6.0, < 2.6.3	2.6.3

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.