This vulnerability is a use‑after‑free flaw in Microsoft QUIC. When an attacker sends specially crafted QUIC traffic, the vulnerable component can attempt to read memory that has already been freed, allowing the attacker to gain access to sensitive data that should not be exposed. The impact is the disclosure of confidential information to an unauthorized network adversary, potentially revealing internal application secrets or configuration details.

The flaw affects several Microsoft products. Enabled versions include Microsoft Visual Studio 2022 17.14, Microsoft Visual Studio 2026 18.10, the Microsoft Native QUIC MsQuic Schannel component, Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including the Server Core installation). All listed products are currently vulnerable and require the security update that addresses CVE‑2026‑85790.

The CVSS score of 5.9 indicates a moderate severity assessment. No EPSS score is available, so the probability of exploitation cannot be quantified, but the vulnerability is exploitable over a network and requires the attacker to send malformed QUIC packets. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation as of now. Risk remains moderate; patching is recommended to eliminate this information disclosure path.