Microsoft QUIC weaknesses in default variable initialization enable an attacker to bypass a security feature over the network, potentially allowing unauthorized network activity. The flaw is classified as CWE-453, indicating that insecure defaults can be exploited for privilege escalation or compromise of confidentiality and integrity. The impact is therefore a direct ability to circumvent intended security measures controlled by QUIC, which may lead to further exploitation if multiple security gates are bypassed.

Affected vendors include Microsoft, with impacted products comprising Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1 as well as Windows Server 2022 and Windows Server 2025 (including Server Core installations).

The CVSS score of 7.5 indicates a high severity risk of unauthorized network bypass. No EPSS score is available, making the precise exploitation likelihood uncertain, but the lack of inclusion in the CISA KEV catalog suggests no actively used exploit has been reported. Attackers would need network connectivity to a QUIC-enabled endpoint; the vulnerability exploits insecure default variable initialization, so the attack vector is likely remote over the network. Due to the nature of QUIC, the exploit could be performed without privileged local access.