-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.Native.Quic.MsQuic.Schannel | nuget | < 2.2.3 | 2.2.3 |
| Microsoft.Native.Quic.MsQuic.OpenSSL | nuget | < 2.2.3 | 2.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from servers processing Version Negotiation packets which should only be client-handled. The key patch adds 'QuicConnIsClient(Connection)' check in QuicConnRecvHeader, indicating this was the missing validation. The CWE-476 (NULL dereference) aligns with crash reports, and the test case demonstrates sending VN packets to servers triggers the issue. No other functions in the diff show equivalent security-critical missing checks.
KEV Misses 88% of Exploited CVEs- Get the report