VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 11, 2026· Updated Aug 14, 2026

CVE-2026-62898

CVE-2026-62898

Description

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 10.0.0, < 10.0.1110.0.11
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 9.0.0, < 9.0.199.0.19
Microsoft.NETCore.App.Runtime.win-arm64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.NETCore.App.Runtime.win-x64NuGet
>= 8.0.0, < 8.0.308.0.30
Microsoft.NETCore.App.Runtime.win-x86NuGet
>= 8.0.0, < 8.0.308.0.30

Affected products

6
  • Microsoft/Net
    cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
    Range: >=8.0.0,<8.0.30
  • Microsoft/Visual Studio2 versions
    cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.38
    • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.8.0,<18.8.3
  • Microsoft/QUICllm-fuzzy
  • osv-coords2 versions
    pkg:bitnami/dotnetpkg:bitnami/dotnet-sdk
    >= 8.0.0, < 8.0.30+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.0.30
    • (no CPE)range: >= 8.0.0, < 8.0.30

Patches

Vulnerability mechanics

References

4

News mentions

2