High CVSS 7.5
CVE-2026-62898
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
What this means
- Exposure
- Exploitable remotely over the network, without authentication and with no action from the victim.
- Impact
- An attacker can read sensitive data.
- Weakness
- Already-freed memory is reused, letting the attacker reclaim it and hijack execution.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle. Start with the instances exposed to the internet.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.