The vulnerability in XQUIC’s STREAM frame handler allows an attacker to send malformed or spoofed QUIC frames during the Initial or Handshake phases. Because the implementation performs inadequate input filtering and does not properly verify cryptographic signatures, these frames can manipulate the protocol state, potentially causing denial of service, corrupting session data, or, if the application processes them unprotected, compromising the host. The flaw maps to CWE‑20 (Improper Input Validation) and CWE‑347 (Untrusted Input Contains Structured Data).

All releases of the XQUIC Project XQUIC on Linux up to and including version 1.8.3 are vulnerable. Users operating legacy versions before the fix are exposed to the described issue.

The CVSS base score of 8.3 indicates high severity. The likely attack vector is network‑based, requiring delivery of malformed QUIC packets and no prior authentication. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the high score and lack of public exploitation reports suggest that the risk remains significant. Based on the description, it is inferred that the attacker can manipulate the protocol state remotely, potentially leading to denial of service or more severe compromise if the application mishandles the frames.