A heap-based buffer overflow occurs in the Microsoft QUIC implementation, allowing an unauthenticated attacker to execute arbitrary code over a network. The exploit compromises confidentiality, integrity, and availability by granting full control over the vulnerable host.

Affected products include Microsoft .NET versions 8.0 through 11.0, Visual Studio 2022 v17.14, Visual Studio 2026 v18.10, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core installations). The vulnerability is present in the included QUIC protocol stack in these environments.

The CVSS score is 9.8, indicating a critical severity. EPSS information is not available, making the current exploitation probability unclear, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based exploitation through QUIC traffic; the vulnerability does not require privileged local access or inter-process communication.