pwned.coffeeUpdated 23 min ago

Past orders

A past order. It may still matter if you haven't patched.

pwned.coffeeOrder ticket · past order · 11 Nov 2026

Double espresso · 355°CcriticalOrder up · fix available

.NET: memory corruption

.NET

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Fix it

.NET 10.0 runtime

  • Upgrade to .NET 10.0 runtime 10.0.14

.NET 11.0 runtime

  • No stable fix yet (only 11.0.0-rc.2.26504.105)

.NET 8.0 runtime

  • Upgrade to .NET 8.0 runtime 8.0.32

.NET 9.0 runtime

  • Upgrade to .NET 9.0 runtime 9.0.21

Microsoft Visual Studio 2022 version 17.14

  • Upgrade to Microsoft Visual Studio 2022 version 17.14.42

Microsoft Visual Studio 2026 version 18.10

  • Upgrade to Microsoft Visual Studio 2026 version 18.10.4

Windows 11 version 23H2

  • Upgrade to Windows 11 version 23H2 10.0.22631.7652

Windows 11 Version 24H2

  • Upgrade to Windows 11 Version 24H2 10.0.26100.9711

Windows 11 Version 25H2

  • Upgrade to Windows 11 Version 25H2 10.0.26200.9711

Windows 11 version 26H1

  • Upgrade to Windows 11 version 26H1 10.0.28000.3231

Windows 11 Version 26H2

  • Upgrade to Windows 11 Version 26H2 10.0.26300.9711

Windows Server 2022

  • Upgrade to Windows Server 2022 10.0.20348.5761

Windows Server 2025

  • Upgrade to Windows Server 2025 10.0.26100.33650

Windows Server 2025 (Server Core installation)

  • Upgrade to Windows Server 2025 (Server Core installation) 10.0.26100.33650

Microsoft.Native.Quic.MsQuic.Schannel nuget

  • dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.5.11-ci.159417053
First seen
Last update
Fixed in
  • Microsoft.Native.Quic.MsQuic.Schannel 2.5.11-ci.159417053
  • .NET 10.0 runtime 10.0.14
  • .NET 11.0 runtime 11.0.0-rc.2.26504.105
  • .NET 8.0 runtime 8.0.32
  • .NET 9.0 runtime 9.0.21
  • Microsoft Visual Studio 2022 version 17.14.42
  • Microsoft Visual Studio 2026 version 18.10.4
  • Windows 11 version 23H2 10.0.22631.7652
  • Windows 11 Version 24H2 10.0.26100.9711
  • Windows 11 Version 25H2 10.0.26200.9711
  • Windows 11 version 26H1 10.0.28000.3231
  • Windows 11 Version 26H2 10.0.26300.9711
  • Windows Server 2022 10.0.20348.5761
  • Windows Server 2025 10.0.26100.33650
Identifiers
CVSS
9.8
Source
news
On the menu as

Timeline

  1. Fix status: unknown → patched.

  2. First reported.

Receipt

Exploitation
No known exploitation
Fix by release line
ProductAffectedFixed inSource
Microsoft.Native.Quic.MsQuic.Schannel (nuget)= 2.5.11-ci.1567556752.5.11-ci.159417053GitHub advisory checked
.NET 10.0 runtime10.0.0 to before 10.0.1410.0.14CVE record (CNA) checked
.NET 11.0 runtime11.0.0 to before 11.0.0-rc.2.26504.10511.0.0-rc.2.26504.105CVE record (CNA) checked
.NET 8.0 runtime8.0.0 to before 8.0.328.0.32CVE record (CNA) checked
.NET 9.0 runtime9.0.0 to before 9.0.219.0.21CVE record (CNA) checked
Microsoft Visual Studio 2022 version 17.1417.14.0 to before 17.14.4217.14.42CVE record (CNA) checked
Microsoft Visual Studio 2026 version 18.1018.10.0 to before 18.10.418.10.4CVE record (CNA) checked
Windows 11 version 23H210.0.22631.0 to before 10.0.22631.765210.0.22631.7652CVE record (CNA) checked
Windows 11 Version 24H210.0.26100.0 to before 10.0.26100.971110.0.26100.9711CVE record (CNA) checked
Windows 11 Version 25H210.0.26200.0 to before 10.0.26200.971110.0.26200.9711CVE record (CNA) checked
Windows 11 version 26H110.0.28000.0 to before 10.0.28000.323110.0.28000.3231CVE record (CNA) checked
Windows 11 Version 26H210.0.26300.0 to before 10.0.26300.971110.0.26300.9711CVE record (CNA) checked
Score
CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA microsoft) for CVE-2026-105016
Last checked

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee