CVE-2026-85790: Microsoft QUIC Information Disclosure Vulnerability

CVE-2026-85790 PUBLISHED CVSS 5.9 MEDIUM

Microsoft QUIC Information Disclosure Vulnerability

Reported by microsoft · Published October 13, 2026

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
windows_11_26h1	microsoft	10.0.28000.3231

CVSS 3.1

5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0
Microsoft	Microsoft Visual Studio 2026 version 18.10	18.10.0
Microsoft	Microsoft.Native.Quic.MsQuic.Schannel	1.9.0
Microsoft	Windows 11 version 23H2	10.0.22631.0
Microsoft	Windows 11 Version 23H2	10.0.22631.0
Microsoft	Windows 11 Version 24H2	10.0.26100.0
Microsoft	Windows 11 Version 25H2	10.0.26200.0
Microsoft	Windows 11 version 26H1	10.0.28000.0
Microsoft	Windows 11 Version 26H2	10.0.26300.0
Microsoft	Windows Server 2022	10.0.20348.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0
microsoft	windows_11_26H1	10.0.28000.0
Microsoft	Windows 11 Version 24H2	10.0.26100.0
microsoft	windows_11_25H2	10.0.26200.0
microsoft	windows_server_2025	10.0.26100.0
microsoft	visual_studio_2022	17.14.0
Microsoft	Windows 11 version 23H2	10.0.22631.0
Microsoft	Windows 11 version 26H1	10.0.28000.0
microsoft	windows_11_24H2	10.0.26100.0

…and 18 more

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-85790
vulnetix vdb fixes CVE-2026-85790

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-85790/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart