ngtcp2 is a C implementation of the QUIC protocol. In all releases prior to 1.22.1, the function that logs transport parameters serializes peer data into a fixed 1024‑byte stack buffer without performing bounds checking. When the qlog callback is enabled, a remote peer can send transport parameters that exceed the buffer size during the QUIC handshake, causing writes beyond the buffer boundary. Based on the description, it is inferred that this stack buffer overflow could corrupt memory and potentially allow an attacker to execute arbitrary code, although such exploitation is not proven.

The vulnerability is present in every ngtcp2 build older than version 1.22.1 when qlog is enabled. All deployments that use ngtcp2 and have the qlog feature active are affected. The fix was included in ngtcp2 1.22.1 and later.

The CVSS score of 7.5 indicates a high severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require a remote peer to initiate a QUIC connection, enable qlog, and transmit transport parameters that overflow the stack buffer. An attacker who successfully triggers the overflow could corrupt memory and potentially gain code execution or disrupt service.