CVE-2026-85790: Microsoft Native.quic.msquic.schannel
Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days.
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Affected products
- Microsoft Native.quic.msquic.schannel: before 2.6.2 (fixed in 2.6.2)
- Microsoft Visual Studio 2022: from 17.14.0, before 17.14.42 (fixed in 17.14.42)
- Microsoft Visual Studio 2026: from 18.10.0, before 18.10.4 (fixed in 18.10.4)
- Microsoft Windows 11 23h2: before 10.0.22631.7652 (fixed in 10.0.22631.7652)
- Microsoft Windows 11 24h2: before 10.0.26100.9711 (fixed in 10.0.26100.9711)
- Microsoft Windows 11 25h2: before 10.0.26200.9711 (fixed in 10.0.26200.9711)
- Microsoft Windows 11 26h1: before 10.0.28000.3231 (fixed in 10.0.28000.3231)
- Microsoft Windows 11 26h2: before 10.0.26300.9711 (fixed in 10.0.26300.9711)
- Microsoft Windows Server 2022: before 10.0.20348.5761 (fixed in 10.0.20348.5761)
- Microsoft Windows Server 2025: before 10.0.26100.33650 (fixed in 10.0.26100.33650)
Affected packages
Published 2026-10-13. Last modified 2026-10-16.