{"id":"CVE-2026-105016","published":"2026-10-13T19:17:57.750","lastModified":"2026-10-16T04:18:23.280","description":"Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Microsoft QUIC allows remote attackers to execute arbitrary code with high privileges. This vulnerability affects the QUIC protocol implementation and can be exploited over the network without authentication.","exploitability":"Exploitation is likely straightforward for skilled attackers with minimal preconditions, requiring only network access to a vulnerable QUIC endpoint with no authentication required.","blast_radius":"The impact could be severe across all systems using Microsoft QUIC, potentially allowing attackers to gain full system control on affected servers and clients that process QUIC traffic.","remediation":"Deploy the Microsoft Windows Update KB5042119 or upgrade to Microsoft QUIC version 1.4.0 or later immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","network","quic","remote"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:47:42.060Z"}}