Use-after-free in Microsoft products - CVE-2026-62898
Published: August 12, 2026
Vulnerability identifier: #VU142006
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62898
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use-after-free in Microsoft QUIC when handling network requests. A remote attacker can send crafted network traffic to disclose sensitive information.
An attacker who successfully exploited this vulnerability could potentially read portions of process memory.
Affected software
.NET
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
How to mitigate CVE-2026-62898
Install security update from vendor's website.
.NET - addressed in versions 8.0.30, 9.0.19
Visual Studio - update to 17.14.38
.NET for Linux - addressed in versions 8.0.30, 9.0.19
.NET for macOS - addressed in versions 8.0.30, 9.0.19
Microsoft .NET Framework - update to 10.0.11
Visual Studio - update to 17.14.38
.NET for Linux - addressed in versions 8.0.30, 9.0.19
.NET for macOS - addressed in versions 8.0.30, 9.0.19
Microsoft .NET Framework - update to 10.0.11