CVE-2026-103577: Microsoft QUIC Security Feature Bypass Vulnerability
Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.
Other sources
Microsoft QUIC Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector indicates network-based exploitation with no privileges or user interaction required. The attacker must still meet the high attack-complexity condition reflected in the scoring data.
Which systems should be evaluated for exposure?
Evaluate deployments of Microsoft QUIC and the listed Windows platforms: Windows 11, Windows Server 2022, and Windows Server 2025. The available data does not identify specific affected versions, builds, or configurations.
What is the likely security impact if exploitation succeeds?
The issue is rated high severity with scope changed. The scoring data indicates no confidentiality impact, low integrity impact, and high availability impact.