VYPR
Get started
← All advisories
Critical severityNVD Advisory· Published Apr 16, 2026

MsQuic has a Remote Elevation of Privilege Vulnerability

CVE-2026-32179

Description

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

#### Patches - Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

MSRC

CVE Info https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32179

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.Native.Quic.MsQuic.OpenSSLNuGet
>= 2.5.0-ci.532574, < 2.5.72.5.7
Microsoft.Native.Quic.MsQuic.SchannelNuGet
>= 2.5.0-ci.532574, < 2.5.72.5.7
Microsoft.Native.Quic.MsQuic.SchannelNuGet
< 2.4.182.4.18
Microsoft.Native.Quic.MsQuic.OpenSSLNuGet
< 2.4.182.4.18

Patches

1
1e6e999b1994

Fix underflow in ACK frame parsing (#5942)

https://github.com/microsoft/msquicGuillaume HetierApr 14, 2026via ghsa
commit
1 file changed · +5 −0
  • src/core/frame.c+5 −0 modified
    @@ -334,6 +334,11 @@ QuicAckFrameDecode(
 
         Largest -= (Block.Gap + 1);
         Count = Block.AckBlock + 1;
+    
+        if (Count > Largest + 1) {
+            *InvalidFrame = TRUE;
+            return FALSE;
+        }
 
         //
         // N.B. The efficiency here isn't great because we are always inserting

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.