{"id":"CVE-2026-100219","published":"2026-10-13T19:17:42.163","lastModified":"2026-10-14T04:18:05.767","description":"Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Microsoft QUIC allows remote attackers to execute arbitrary code with high privileges. This occurs when the QUIC protocol implementation improperly handles memory deallocation, creating a scenario where freed memory can be accessed again, potentially leading to code execution.","exploitability":"Exploitation is relatively straightforward for an attacker with network access, requiring only a connection to a vulnerable QUIC endpoint with a specially crafted packet sequence that triggers the memory corruption.","blast_radius":"The impact could be severe across all systems using Microsoft QUIC, including web servers, cloud services, and applications that rely on this protocol for secure communication, potentially allowing attackers to gain full system control.","remediation":"Apply the latest Microsoft security updates for Windows and related components, specifically targeting the QUIC implementation fixes in the 2026-04 cumulative update or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","network","quic","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:20.545Z"}}