high
advisory
Public PoC Exploit for msquic Vulnerability
A public proof-of-concept exploit targeting an integer underflow in the msquic library has been released, enabling potential remote code execution.
CVE search metadata
CVE search record: CVE-2026-105016. Severity: critical. CVSS: 9.8. EPSS: 1.66%. KEV: no. Brief: Public PoC Exploit for msquic Vulnerability. Brief link: https://feed.craftedsignal.io/briefs/2026-11-msquic-rce-cve-2026-105016/
Triage facts
Revision 1- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 12, 01:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C1Likely
A public proof-of-concept (PoC) exploit has been identified for a vulnerability in the msquic library (CVE-2026-105016). The underlying issue is an integer underflow in the QuicStreamSendWrite function, which can lead to a heap overflow and subsequent arbitrary code execution. The exploit is currently documented as targeting Windows x64 environments.