{"id":"CVE-2026-32179","aliases":["GHSA-gvvw-8j96-8g5r"],"status":"published","title":"MsQuic has a Remote Elevation of Privilege Vulnerability","description":"### Summary\nImproper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.\n\n### Details\n Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.\n\n#### Patches\n- Fix underflow in ACK frame parsing - 1e6e999b\n\n### Impact\nAn attacker who successfully exploited this vulnerability could gain elevated privileges.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2026-04-16T01:04:03Z","modified":"2026-05-08T15:32:31Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.OpenSSL","fixed_in":["2.5.7","2.4.18"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.Schannel","fixed_in":["2.5.7","2.4.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.OpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-ci.532574"},{"fixed":"2.5.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.Schannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-ci.532574"},{"fixed":"2.5.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.Schannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.OpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.OpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-ci.532574"},{"fixed":"2.5.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.Schannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-ci.532574"},{"fixed":"2.5.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.Schannel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18"}]}],"versions":["1.8.0"]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.Native.Quic.MsQuic.OpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18"}]}],"versions":["1.8.0"]}],"references":[{"url":"https://github.com/microsoft/msquic/security/advisories/GHSA-gvvw-8j96-8g5r","tags":["web"]},{"url":"https://github.com/microsoft/msquic/commit/1e6e999b199430effeefee3d85baa0c9dd35ad5e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gvvw-8j96-8g5r"},{"url":"https://github.com/microsoft/msquic","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gvvw-8j96-8g5r","title":"MsQuic has a Remote Elevation of Privilege Vulnerability","description":"### Summary\nImproper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.\n\n### Details\n Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.\n\n#### Patches\n- Fix underflow in ACK frame parsing - 1e6e999b\n\n### Impact\nAn attacker who successfully exploited this vulnerability could gain elevated privileges.","status":"published","published":"2026-04-16T01:04:03Z","modified":"2026-05-08T15:19:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:40:03.762927Z"}],"osv":[{"id":"GHSA-gvvw-8j96-8g5r","title":"MsQuic has a Remote Elevation of Privilege Vulnerability","description":"### Summary\nImproper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.\n\n### Details\n Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.\n\n#### Patches\n- Fix underflow in ACK frame parsing - 1e6e999b\n\n### Impact\nAn attacker who successfully exploited this vulnerability could gain elevated privileges.","status":"published","published":"2026-04-16T01:04:03Z","modified":"2026-05-08T15:32:31.86348Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}