Heap-based buffer overflow in Microsoft products - CVE-2026-105016

Vulnerability identifier: #VU154330

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-105016

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft QUIC when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

.NET
Microsoft Windows
Windows Server
Visual Studio
Microsoft .NET Framework

Install security update from vendor's website.

.NET - addressed in versions 8.0.32, 9.0.21
Microsoft Windows - addressed in versions 11 23H2 10.0.22631.7652, 11 24H2 10.0.26100.9711, 11 25H2 10.0.26200.9711, 11 26H1 10.0.28000.3231
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.14
Windows Server - addressed in versions 2022 10.0.20348.5761, 2025 10.0.26100.33650

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105016
• https://support.microsoft.com/help/5126655

• Multiple vulnerabilities in Microsoft Windows