crítica
CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.
Descripción
### Summary Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network. ### Details Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame. #### Patches - Fix underflow in ACK frame parsing - 1e6e999b ### Impact An attacker who successfully exploited this vulnerability could gain elevated privileges.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | Microsoft.Native.Quic.MsQuic.OpenSSL, Microsoft.Native.Quic.MsQuic.Schannel, microsoft.native.quic.msquic.openssl y 1 más | 2.5.7, 2.4.18 |
| alpine 3.21 | libmsquic | 2.4.18-r0 |
| alpine 3.22 | libmsquic | 2.4.18-r0 |
| alpine 3.23 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.20 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.21 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.24 | libmsquic | 2.4.18-r0 |
Mostrar las 10 entradas de 7 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | Microsoft.Native.Quic.MsQuic.OpenSSL | 2.5.7, 2.4.18 |
| nuget::GitHub Security Advisory NuGet | Microsoft.Native.Quic.MsQuic.Schannel | 2.5.7, 2.4.18 |
| nuget::GitHub Security Advisory NuGet | microsoft.native.quic.msquic.openssl | 2.5.7, 2.4.18 |
| nuget::GitHub Security Advisory NuGet | microsoft.native.quic.msquic.schannel | 2.5.7, 2.4.18 |
| alpine 3.21 | libmsquic | 2.4.18-r0 |
| alpine 3.22 | libmsquic | 2.4.18-r0 |
| alpine 3.23 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.20 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.21 | libmsquic | 2.4.18-r0 |
| rapidfort alpine 3.24 | libmsquic | 2.4.18-r0 |