Cloudflare Quiche contains a use‑after‑free vulnerability in two FFI iterator functions. These functions return a pointer to a ConnectionId that is freed at the end of the function’s scope, resulting in the application dereferencing freed memory. The most common consequence is a process crash, but depending on the allocator state, the read may expose adjacent heap data, yielding limited information disclosure or incorrect handling of connection identifiers.

The vulnerability is limited to the Cloudflare Quiche library. Only applications that incorporate the quiche_connection_id_iter_next or quiche_conn_retired_scid_next FFI functions are affected, and these functions are disabled by default through a build‑time feature flag. Users running Quiche versions older than 0.29.2 that have these functions enabled are at risk.

With a CVSS score of 5.6, the vulnerability has moderate severity. No EPSS data is available, and it is not listed in CISA KEV, indicating no documented exploitation. Exploitation requires the application to link to the vulnerable FFI functions, so an attacker would need interactive access to the application environment or supply malicious input that triggers the deallocated pointer dereference. The primary impact remains denial of service through crash, with a secondary risk of minimal data exposure.