Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Summary

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

Patches

• Guard path promotion e0f55b5

Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.

Summary

Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.

Details

Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.

Patches

• Fix underflow in ACK frame parsing - 1e6e999b

Impact

An attacker who successfully exploited this vulnerability could gain elevated privileges.

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

• Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/d364feeda0dd8b729eca6fef149c1ef98630f0cb

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

Impact

The MsQuic server application or process will crash, resulting in a denial of service.

Patches

The following patch was made:

• Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343

Workarounds

Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.