Description
### Summary
Improper input validation in Microsoft QUIC allows an unauthorized attacker to elevate privileges over a network.
### Details
Improper Input Validation Integer Underflow (Wrap or Wraparound) when decoding ACK frame.
#### Patches
- Fix underflow in ACK frame parsing - 1e6e999b
### Impact
An attacker who successfully exploited this vulnerability could gain elevated privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.Native.Quic.MsQuic.OpenSSL | >= 2.5.0-ci.532574, < 2.5.7 | 2.5.7 | GHSA-gvvw-8j96-8g5r |
| NuGet | Microsoft.Native.Quic.MsQuic.OpenSSL | < 2.4.18 | 2.4.18 | GHSA-gvvw-8j96-8g5r |
| NuGet | Microsoft.Native.Quic.MsQuic.Schannel | >= 2.5.0-ci.532574, < 2.5.7 | 2.5.7 | GHSA-gvvw-8j96-8g5r |
| NuGet | Microsoft.Native.Quic.MsQuic.Schannel | < 2.4.18 | 2.4.18 | GHSA-gvvw-8j96-8g5r |