CVE-2023-38171: Microsoft QUIC denial of service via null pointer dereference

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated denial of service with a high CVSS (7.5) and very high EPSS, though no confirmed in-the-wild exploitation is documented.

What it is

CVE-2023-38171 is a denial of service flaw in Microsoft's QUIC implementation affecting .NET, Visual Studio 2022, Windows 11 22H2 and Windows Server 2022. The record classifies it as a null pointer dereference (CWE-476) but provides no further technical detail on the trigger. Because QUIC is a network-facing transport, an unauthenticated remote attacker can potentially disrupt service availability.

Impact

An attacker can cause a denial of service, degrading or halting QUIC-based services on affected systems. The CVSS vector shows no confidentiality or integrity impact, only availability (A:H).

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), per the CVSS vector. The description does not specify the exact packet or handshake condition that triggers the null pointer dereference.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.697 (99.3rd percentile), indicating elevated predicted exploitation likelihood. The only references are Microsoft patch advisories.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-38171 across .NET, Visual Studio 2022, Windows 11 22H2 and Windows Server 2022.
• Inventory all systems and applications using Microsoft's QUIC stack and prioritize internet-facing ones for patching.
• Where patching cannot be immediate, restrict or monitor inbound UDP 443 (QUIC) traffic at the perimeter.
• Track vendor guidance for any additional configuration or workaround specific to the affected products.

Detection

• Monitor for unexpected process crashes or restarts in services using Microsoft's QUIC stack (e.g., HTTP/3 endpoints, .NET apps).
• Watch for spikes or anomalies in inbound UDP 443 traffic that correlate with service availability drops.
• Correlate Windows application/event logs for null-pointer-related crash signatures in QUIC-handling components with network activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.