GHSA-92f5-vc22-8j33

Quick fix

GHSA-92f5-vc22-8j33 — Microsoft.Native.Quic.MsQuic.OpenSSL: upgrade to the fixed version with the command below.

dotnet add package Microsoft.Native.Quic.MsQuic.OpenSSL --version 2.5.10

Details

# Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

# Details

New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.

## Patches

- Guard path promotion [e0f55b5](https://github.com/microsoft/msquic/commit/e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b)

# Impact

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.