CVE-2026-62898

Microsoft QUIC is a fast networking feature used for certain modern internet connections. This bug can accidentally reuse memory that should no longer be used, which can let an attacker over the network see confidential information. Think of it like handing out a scrap of paper that was “thrown away,” but someone else ends up reading the old message on it.

This matters if you build or run apps on affected .NET or Visual Studio versions that are using Microsoft QUIC for internet-facing network traffic. If Microsoft QUIC is not used, the risk may not apply, but the findings note the reachable-by-default status is unknown—so you should verify whether QUIC is enabled in your environment. Because the issue is network-accessible without authentication, it becomes a risk once an attacker can reach your QUIC-enabled endpoints.

This is RED because it’s an unauthenticated network information disclosure flaw in a commonly used platform component, and Microsoft has provided fixed versions for multiple supported branches. While a dated, clear public exploitation report isn’t provided here, the activity signal indicates real threat interest (including a named actor in patch-related reporting). Prioritize patching these components quickly, especially for any internet-facing QUIC usage.

1. Confirm affected software in use

   • Inventory machines and build/deploy environments running: .NET 8.0, .NET 9.0, .NET 10.0 and Microsoft Visual Studio 2022 version 17.14 and/or Microsoft Visual Studio 2026 version 18.8.
   • Determine the exact installed/update level to compare with the fixed versions.

2. Confirm Microsoft QUIC usage

   • Verify whether your internet-facing services use Microsoft QUIC (for example, any QUIC/HTTP3-enabled endpoints).
   • If you have multiple environments (prod/staging/dev), focus first on anything exposed to the public internet.
   • If your team can’t confirm quickly, assume risk for any externally reachable services that may be configured to use QUIC, and validate configuration with your app/platform owner.

3. Upgrade to fixed versions (do not delay once identified)

   • .NET 10.0: upgrade to 10.0.11
   • .NET 8.0: upgrade to 8.0.30
   • .NET 9.0: upgrade to 9.0.19
   • Microsoft Visual Studio 2022 version 17.14: upgrade to 17.14.38
   • Microsoft Visual Studio 2026 version 18.8: upgrade to 18.8.3
   • For environments that include “visual studio 2022” and “visual studio 2026” umbrella cases, align to the same fixed targets above.

4. Validate after upgrade

   • Restart/roll services as appropriate.
   • Verify application health checks and basic network connectivity for QUIC-enabled endpoints.
   • Confirm you didn’t accidentally change routing or listener settings.

5. Temporary mitigation if patching is not immediate

   • Disable or remove Microsoft QUIC usage for internet-facing services until patched (exact steps depend on your hosting/app configuration; coordinate with your platform/application owner or vendor).
   • Keep internal/non-exposed environments unchanged only if they are not reachable from the internet.

6. What to monitor

   • Look for unusual inbound traffic patterns to QUIC-enabled endpoints.
   • Monitor application/service logs for errors or crashes around connection handling (the core issue is memory handling during network processing).

7. Timing

   • The prompt does not provide a CISA due date here; follow your organization’s emergency patch process for RED vulnerabilities and prioritize internet-facing QUIC endpoints first.

Severity is high (information disclosure) with network attack vector and no authentication required, meaning an attacker can potentially exploit it remotely if Microsoft QUIC is in use. The underlying weakness is CWE-416 (use-after-free): freed memory is reused during Microsoft QUIC processing, enabling disclosure of confidential data. KEV listing is not present in the provided findings. No public exploit code is recorded in the provided findings, and there is no clear dated press claim of exploitation; however, patch-related reporting indicates threat interest (actor Lazarus group). The system received a RED verdict, reflecting the confirmed fix availability across .NET and Visual Studio versions and the real-world attacker incentive for data theft. (EPSS is provided as a prediction in the findings, but it is not used as a public urgency driver due to the RED handling.)