Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
MEDIUM severity

CVE-2026-85790 — Microsoft.Native.Quic.MsQ…

MEDIUM

CVE-2026-85790 is a medium-severity (CVSS 5.9) Use After Free vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. A fix is available for Microsoft.Native.Quic.MsQuic.Schannel — see the affected versions and patch details below.

Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability

Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-85790.

EPSS Exploitation Probability

via FIRST.org ↗
0.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs52th percentile — riskier than 52% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-85790 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
.NETMicrosoft.Native.Quic.MsQuic.Schannel.NETMicrosoft.Native.Quic.MsQuic.Schannel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Various vulnerabilities in MsQuic are addressed by an updated native-binary dependency update.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/470

CVSS Details

  • Version: 3.1

  • Severity: Moderate

  • Score: 5.9

  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Weakness: CWE-416 (Use After Free)

Affected Platforms

  • Platforms: Windows
  • Architectures: All

<a name="affected-packages"></a>Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package nameAffected versionPatched version
Microsoft.Native.Quic.MsQuic.Schannel>= 1.9.0, < 2.5.122.5.12
Microsoft.Native.Quic.MsQuic.Schannel>= 2.6.0, < 2.6.32.6.3

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

  1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
  2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-85790

Acknowledgements

  • reinusKR

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetMicrosoft.Native.Quic.MsQuic.Schannel≥ 1.9.0&&< 2.5.122.5.12dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.5.12
.NETNuGetMicrosoft.Native.Quic.MsQuic.Schannel≥ 2.6.0&&< 2.6.32.6.3dotnet add package Microsoft.Native.Quic.MsQuic.Schannel --version 2.6.3

Affected Products

10 products · 15 configurations
Application
native.quic.msquic.schannelmicrosoft
< 2.6.2
range
Application
visual studio 2022microsoft
≥ 17.14.0 && < 17.14.42
range
Application
visual studio 2026microsoft
≥ 18.10.0 && < 18.10.4
range
OS
windows 11 23h2microsoft
< 10.0.22631.7652
range
OS
windows 11 24h2microsoft
< 10.0.26100.9711
range
OS
windows 11 25h2microsoft
< 10.0.26200.9711
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Microsoft.Native.Quic.MsQuic.Schannel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Microsoft.Native.Quic.MsQuic.Schannel to 2.5.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-85790 is resolved across your whole dependency graph.

  3. Workarounds

    Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Various vulnerabilities in MsQuic are addressed by an updated native-binary dependency update. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/470 ## CVSS Details - **Version:** 3.1 - **Severity:** Moderate - **Score:** 5.9 - **Vector:** `CVSS:3.1/AV:N/AC:H/P
O3 Security · Impact-Aware SCA

Is CVE-2026-85790 in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-85790: Microsoft.Native.Quic — Fixed in 2.5.12