CVE-2026-105016

CRITICAL

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/13/2026Modified: 10/22/2026

Related Intelligence (2)

CRITICALZero Day

October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days

Microsoft released a record-shattering 1,407 CVEs to be plugged today on October Patch Tuesday, breaking the 2020 record of 1,261. The list was so long that its release was several hours later than the usual 1 p.m. Eastern drop time, somewhat frustrating admins. The bugs include three zero-day vulnerabilities, one of which has been exploited. The zero day being exploited, and that should be dealt

CVE-2026-96951CVE-2026-21510
CSO Online
CRITICALVulnerability

NVD CRITICAL: CVE-2026-105016 — Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to ...

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVE-2026-105016
NIST NVD

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016