PT-2026-33284 · Nuget · Microsoft.Native.Quic.Msquic.Openssl+1

Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-32179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MsQuic (affected versions not specified)

Description Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. The issue is caused by an integer underflow (wrap or wraparound) that occurs when decoding the ACK frame.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-32179

GHSA-GVVW-8J96-8G5R

Affected Products

Microsoft.Native.Quic.Msquic.Openssl

Microsoft.Native.Quic.Msquic.Schannel

References · 7

• https://osv.dev/vulnerability/GHSA-gvvw-8j96-8g5r · Vendor Advisory
• https://github.com/microsoft/msquic · Note
• https://github.com/microsoft/msquic/security/advisories/GHSA-gvvw-8j96-8g5r · Note
• https://github.com/microsoft/msquic/commit/1e6e999b199430effeefee3d85baa0c9dd35ad5e · Note
• https://reddit.com/r/VulnMatter/comments/1sn0wwt/resumen_diario_de_vulnerabilidades_16042026 · Reddit Post
• https://twitter.com/pulsepatchio/status/2044618624925622729 · Twitter Post
• https://twitter.com/CCBalert/status/2044784117108125860 · Twitter Post