CVE-2026-62815 – Microsoft QUIC Remote Code Execution Vulnerability

CVE-2026-62815 is a Critical use-after-free vulnerability in Microsoft QUIC that can allow an unauthenticated remote attacker to execute code on an affected Windows system. Exploitation requires low attack complexity and can be performed over the network without privileges or user interaction.

CVSS Score: 9.8.

SEVERITY: Critical.

THREAT:
An unauthorized remote attacker can target an affected QUIC service by sending a specially crafted network packet. Successful exploitation could result in remote code execution with high impact to confidentiality, integrity, and availability.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free memory condition in Microsoft QUIC (CWE-416). An unauthenticated attacker can send a specially crafted packet to an affected service over the network to trigger the flaw. Attack complexity is low, and successful exploitation can allow execution of attacker-controlled code on the target system. No privileges or user interaction are required.

EXPLOITABILITY:
Affected software includes Windows 11 versions 24H2, 25H2, and 26H1 on ARM64 and x64 systems, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT:
Successful exploitation could compromise affected endpoints or servers through remote code execution, threatening the confidentiality, integrity, and availability of business systems. Because authentication and user interaction are not required, exposed vulnerable services could present a significant organizational risk.

WORKAROUND:
No mitigation or workaround is identified. An official fix is available, and affected systems require a restart when applying the listed updates.

URGENCY:
This is a Critical vulnerability with a CVSS base score of 9.8 and a network-based attack path requiring no privileges or user interaction. Although exploitation is not currently reported, the low attack complexity and potential for remote code execution make timely deployment important.