---
id: "CVE-2026-88236"
page: "https://infrastack.ai/live/CVE-2026-88236"
kind: "vulnerability"
aliases: ["CVE-2026-88236"]
title: "Microsoft QUIC: unauthenticated network attacker can crash the service (null pointer dereference)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft QUIC", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["denial-of-service", "msquic", "quic", "runtime", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:32+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T20:42:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88236", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88236", "first_seen_at": "2026-11-10T20:42:38+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88236"]}]
exploit_sources: []
---

# Microsoft QUIC: unauthenticated network attacker can crash the service (null pointer dereference)

Link for people: https://infrastack.ai/live/CVE-2026-88236 (this .md is for agents)

A null pointer dereference in Microsoft's QUIC protocol implementation can be triggered over the network by an unauthenticated attacker. The result is a denial of service, meaning the affected service crashes or stops responding.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft QUIC affected range not listed fixed no fixed version listed

## How to check

Open the MSRC Security Update Guide page for CVE-2026-88236 in a browser (it is JavaScript-only) and read the Security Updates table for your Windows build and KB. Then compare your installed build and see whether any service listens for QUIC (UDP 443). Affected builds: unknown.

## Fix

Install the November 2026 Microsoft security update for your Windows version (MSRC marks customer action required). Exact KB and build: unknown, the API record we read does not list them.

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88236
- 2026-11-10T20:42:38+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88236 — MSRC API record read (Important, 7.5, Exploitation Less Likely, not publicly disclosed, not exploited, released 2026-11-10). It has no product/build/KB list and the HTML page needs JavaScript, so affected versions and fix are unknown. Nothing verified. Revisit when the MSRC table is readable. The msquic GitHub PRs and OpenSSL QUIC CVEs seen in search are not shown to be this CVE.

## Documents

- [advisory] MSRC: CVE-2026-88236 Microsoft QUIC Denial of Service Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88236

## From the sources

Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_