CVE-2026-105794Critical· 9.1▾ Midnight

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score50/ 100 · Moderate

impact 50.1 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 6, 2026

Updated

Oct 6, 2026

CVSS

9.1

Vendor

microsoft

Product

msquic

CWE

CWE-295

Depth score

50 · Moderate

EPSS

—

Platforms

—

Source

CVEORG

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

microsoft CWE-295 #cve.org

Affected

msquic < 2.4.20
msquic >= 2.5.0, < 2.5.11
msquic >= 2.6.0, < 2.6.1

Full technical detail▾

Overview

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

Affected

msquic < 2.4.20
msquic >= 2.5.0, < 2.5.11
msquic >= 2.6.0, < 2.6.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org