.NET 10.0 vulnerability

What happened

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Affected versions

.NET 10.0: 10.0.0 through before 10.0.14 (custom); 11.0.0 through before 11.0.0-rc.2.26504.105 (custom); 8.0.0 through before 8.0.32 (custom); 9.0.0 through before 9.0.21 (custom); 17.14.0 through before 17.14.42 (custom); 18.10.0 through before 18.10.4 (custom); 10.0.22631.0 through before 10.0.22631.7652 (custom); 10.0.26100.0 through before 10.0.26100.9711 (custom); 10.0.26200.0 through before 10.0.26200.9711 (custom); 10.0.28000.0 through before 10.0.28000.3231 (custom); 10.0.26300.0 through before 10.0.26300.9711 (custom); 10.0.20348.0 through before 10.0.20348.5761 (custom); 10.0.26100.0 through before 10.0.26100.33650 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.