NUGET · AUGUST 2026 · EARLY WARNING

Microsoft QUIC Vulnerability: Critical CVE in nuget Package

Q: Am I affected?

You are affected if you are using nuget/Microsoft.Native.Quic.MsQuic.OpenSSL version less than 2.4.19.

Q: What should I do right now?

Check your package version and update to 2.4.19 or higher if you are using an affected version. Monitor official sources for updates and consider alternative solutions if necessary.

Q: Has this been exploited in the wild?

No, this vulnerability has not been reported as exploited in the wild.

Q: What is the severity of this vulnerability?

The severity of this vulnerability is classified as critical.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: microsoft.native.quic.msquic.openssl (nuget)
Affected versions: < 2.4.19
Patched version: Not yet available

GHSA-2Q33-CF8W-7Q23GHSA-92F5-VC22-8J33

An early warning has been issued for a critical vulnerability in Microsoft QUIC that could allow unauthorized code execution over a network. The affected package is nuget/Microsoft.Native.Quic.MsQuic.OpenSSL.

What happened

An early warning has been issued for a critical vulnerability in Microsoft QUIC. This vulnerability, tracked as GHSA-2Q33-CF8W-7Q23 and GHSA-92F5-VC82-8J33, is a use after free issue that could allow an unauthorized attacker to execute code over a network. The affected package is nuget/Microsoft.Native.Quic.MsQuic.OpenSSL, specifically versions less than 2.4.19. This vulnerability has not yet been exploited in the wild, and no supply-chain attack has been reported. The issue was first flagged on August 11, 2026.

To assess your exposure, check if your systems use the nuget package Microsoft.Native.Quic.MsQuic.OpenSSL and ensure that the version is 2.4.19 or higher. If you are using an affected version, consider updating to a non-vulnerable version or exploring alternative solutions.

What to do about it

Check the version of nuget/Microsoft.Native.Quic.MsQuic.OpenSSL in your systems.
If you are using a version less than 2.4.19, update to version 2.4.19 or higher.
Consider alternative solutions if updating is not feasible.
Monitor the GitHub Advisory Database and other official sources for updates on the vulnerability.
Implement network-level protections to mitigate potential exploitation attempts.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If microsoft.native.quic.msquic.openssl is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using nuget/Microsoft.Native.Quic.MsQuic.OpenSSL version less than 2.4.19.

What should I do right now?

Check your package version and update to 2.4.19 or higher if you are using an affected version. Monitor official sources for updates and consider alternative solutions if necessary.

Has this been exploited in the wild?

No, this vulnerability has not been reported as exploited in the wild.

What is the severity of this vulnerability?

The severity of this vulnerability is classified as critical.

Sources

[GHSA-2q33-cf8w-7q23] Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability

Join the 0Day waitlist →

← Back to all threats