Microsoft.Native.Quic.MsQuic.Schannel (NuGet)

Known vulnerabilities and malicious package reports for Microsoft.Native.Quic.MsQuic.Schannel on NuGet, live from OSV, with CISA KEV exploitation status and EPSS scores.

Known package reports

0 malicious package reports and 7 vulnerabilities returned by OSV. Check a specific version to see which reports apply.

GHSA-xh5m-8qqp-c5x7: Vulnerability

Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel

Published .

Updated .

Reported affected releases: 1.8.0.

Affected ranges: introduced 0, fixed 2.2.3.

Fix versions reported by the advisory: 2.2.3.

Severity: HIGH.

CVE-2023-38171

GHSA-fr44-546p-7xcp: Vulnerability

MsQuic Remote Denial of Service Vulnerability

Published .

Updated .

Reported affected releases: 1.8.0.

Affected ranges: introduced 0, fixed 2.2.3.

Fix versions reported by the advisory: 2.2.3.

Severity: HIGH.

CVE-2023-36435

GHSA-5gjq-3f94-rcf7: Vulnerability

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Published .

Updated .

Reported affected releases: 2.5.11-ci.156755675.

Affected ranges: introduced 2.5.11-ci.156755675, fixed 2.5.11-ci.159417053.

Fix versions reported by the advisory: 2.5.11-ci.159417053.

Severity: CRITICAL.

CVE-2026-105016

GHSA-92f5-vc22-8j33: Vulnerability

Microsoft QUIC: Remote Code Execution Vulnerability

Published .

Updated .

Reported affected releases: 1.8.0.

Affected ranges: introduced 2.5.3, fixed 2.5.10; introduced 0, fixed 2.4.19.

Fix versions reported by the advisory: 2.5.10, 2.4.19.

Severity: CRITICAL.

CVE-2026-62815

GHSA-2mxg-prvg-9jfg: Vulnerability

Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability

Published .

Updated .

Affected ranges: introduced 1.9.0, fixed 2.6.2.

Fix versions reported by the advisory: 2.6.2.

Severity: MEDIUM.

CVE-2026-85790

GHSA-gvvw-8j96-8g5r: Vulnerability

MsQuic has a Remote Elevation of Privilege Vulnerability

Published .

Updated .

Reported affected releases: 1.8.0.

Affected ranges: introduced 2.5.0-ci.532574, fixed 2.5.7; introduced 0, fixed 2.4.18.

Fix versions reported by the advisory: 2.5.7, 2.4.18.

Severity: CRITICAL.

CVE-2026-32179

GHSA-2x7m-gf85-3745: Vulnerability

Remote Denial of Service Vulnerability in Microsoft QUIC

Published .

Updated .

Reported affected releases: 1.8.0.

Affected ranges: introduced 2.2.0, fixed 2.2.7; introduced 2.3.0, fixed 2.3.5; introduced 0, fixed 2.1.12.

Fix versions reported by the advisory: 2.2.7, 2.3.5, 2.1.12.

Severity: HIGH.

Source: OSV, including OpenSSF malicious-package reports and GitHub advisories. No known report is not proof a package is safe.