Verified

CVE-2026-105794: msquic < 2.4.20, >= 2.5.0, < 2.5.11, >= 2.6.0, < 2.6.1

CVE-2026-105794 affects Microsoft.Native.Quic.MsQuic.OpenSSL. Affected range: < 2.4.20. Fixed version: 2.4.20. Affected range: >= 2.5.0, < 2.5.11. Fixed version: 2.5.11. Affected range: >= 2.6.0, < 2.6.1. Fixed version: 2.6.1.

Affected technology

msquic · < 2.4.20, >= 2.5.0, < 2.5.11, >= 2.6.0, < 2.6.1
microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. Vendor/CNA’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 2026-10-06 17:56:31.878217+00:00

CWE: CWE-295
Product: Microsoft.Native.Quic.MsQuic.OpenSSL
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-06 17:57:05.567630+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-07 02:34:12.333111+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-105794.html