CVE-2026-11941

Executive Summary

CVE-2026-11941 is a use-after-free vulnerability in Cloudflare's Quiche library, affecting the FFI (Foreign Function Interface) functions quiche_connection_id_iter_next and quiche_conn_retired_scid_next. These functions return a pointer to a ConnectionId object that is immediately dropped at the end of the function scope, leaving the pointer dangling. An application calling these functions will dereference freed memory, leading to undefined behavior, most likely a denial of service (process crash) or, in limited cases, information disclosure. The FFI API is disabled by default via a build-time feature flag, reducing the attack surface. The vulnerability is patched in quiche version 0.29.2.

Supply Chain & Package Security

Quiche is a Rust library for QUIC protocol implementation, distributed as a crate on crates.io. Applications that depend on quiche and enable the FFI feature flag are affected. The vulnerability is not exploitable through the Rust API directly; only C/C++ applications using the FFI bindings are at risk. Users should update their Cargo.toml to require quiche >= 0.29.2.

CVSS Breakdown & Threat Level

• CVSS Score: 5.6 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have the ability to call the affected FFI functions from within the application.
• Attack Complexity: Low (AC:L) – No special conditions required beyond calling the function.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The user must run the application that calls the vulnerable function.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Potential limited information disclosure from adjacent heap memory.
• Integrity Impact: None (I:N) – No data modification possible.
• Availability Impact: High (A:H) – Most likely outcome is a process crash (denial of service).

Threat Level: Medium. The vulnerability requires local access and user interaction, and the FFI API is disabled by default. However, if exploited, it can cause a denial of service.

Deep Dive & Mechanics

The vulnerability lies in the FFI functions quiche_connection_id_iter_next and quiche_conn_retired_scid_next. These functions are designed to iterate over connection IDs and return a pointer to a ConnectionId structure to the caller. However, the implementation incorrectly drops the owned ConnectionId at the end of the function scope, while still returning a pointer to the now-freed memory.

Root Cause: In Rust, when a value is moved out of a function, ownership is transferred. However, in these FFI functions, the ConnectionId is created or obtained within the function, and then a raw pointer to it is returned. The Rust compiler does not track the lifetime of the pointer, and the ConnectionId is dropped when the function returns, leaving the pointer dangling.

Impact: When the caller dereferences the returned pointer, it accesses freed memory. This can lead to:

• Denial of Service: The most common outcome is a segmentation fault or access violation, crashing the process.
• Information Disclosure: If the freed memory is reused by the allocator for other data, the caller may read adjacent heap contents, potentially leaking sensitive information.
• Incorrect Behavior: The caller may use the corrupted data as a connection identifier, leading to protocol errors.

Affected Functions:

• quiche_connection_id_iter_next
• quiche_conn_retired_scid_next

Mitigation: The fix in quiche 0.29.2 ensures that the ConnectionId is not dropped prematurely, likely by returning the value by value or by using a different ownership model.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable FFI function
#[no_mangle]
pub extern "C" fn quiche_connection_id_iter_next(iter: *mut ConnectionIdIter) -> *const ConnectionId {
    let iter = unsafe { &mut *iter };
    match iter.next() {
        Some(cid) => {
            // cid is owned here, but we return a pointer to it
            // cid is dropped at the end of this scope
            &cid as *const ConnectionId
        }
        None => std::ptr::null(),
    }
}

Patched Code (Conceptual):

// Patched FFI function - returns by value or uses a different approach
#[no_mangle]
pub extern "C" fn quiche_connection_id_iter_next(iter: *mut ConnectionIdIter, out: *mut ConnectionId) -> bool {
    let iter = unsafe { &mut *iter };
    match iter.next() {
        Some(cid) => {
            // Write the value to the output pointer, avoiding dangling reference
            unsafe { *out = cid; }
            true
        }
        None => false,
    }
}

The patched version avoids returning a dangling pointer by writing the value to a caller-provided buffer or by using a different API design.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A C/C++ application that uses the quiche FFI and enables the ffi feature flag.
• Ability to call quiche_connection_id_iter_next or quiche_conn_retired_scid_next.

Exploitation Steps:

1. Identify the vulnerable functions: Look for calls to quiche_connection_id_iter_next or quiche_conn_retired_scid_next in the application code.
2. Trigger the vulnerability: Call the function and immediately dereference the returned pointer.
3. Observe the crash: The application will likely crash with a segmentation fault.
4. Potential information disclosure: If the allocator reuses the freed memory, the returned pointer may point to other heap data. The attacker can read this data by accessing the pointer.

Example Code (C):

#include <quiche.h>

void trigger_uaf() {
    // Assume iter is a valid ConnectionIdIter pointer
    const quiche_connection_id *cid = quiche_connection_id_iter_next(iter);
    if (cid != NULL) {
        // Dereference the dangling pointer
        printf("Connection ID: %p\n", cid);
        // This will likely crash or read freed memory
    }
}

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor for crashes or segmentation faults in applications using quiche FFI.
• Use memory debugging tools (e.g., AddressSanitizer, Valgrind) to detect use-after-free errors.
• Check for calls to the vulnerable functions in the application's source code.

Hunting:

• Search for quiche_connection_id_iter_next and quiche_conn_retired_scid_next in binary or source code.
• Look for applications that link against quiche with the ffi feature enabled.

Indicators of Compromise (IOCs)

• Process Crashes: Unexpected segmentation faults or access violations in applications using quiche FFI.
• Memory Corruption: Signs of heap corruption or invalid memory access in logs.
• Application Logs: Entries indicating failed connection ID iteration or invalid connection identifiers.

File IOCs:

• Quiche library versions < 0.29.2 with the FFI feature enabled.

Network IOCs:

• None directly, as this is a local vulnerability.

Detection Engineering

YARA Rule

rule CVE_2026_11941_Quiche_UAF {
    meta:
        description = "Detects quiche library versions vulnerable to CVE-2026-11941"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11941"
    strings:
        $func1 = "quiche_connection_id_iter_next"
        $func2 = "quiche_conn_retired_scid_next"
        $version = "quiche 0." // Match version strings
    condition:
        ($func1 or $func2) and $version
}

Sigma Rule

title: CVE-2026-11941 - Quiche Use-After-Free in FFI Functions
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes or memory errors related to quiche FFI use-after-free
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11941
logsource:
    category: application
    product: quiche
detection:
    selection:
        EventID: 1000 // Windows crash event
        ApplicationName: "*quiche*"
    condition: selection
falsepositives:
    - Legitimate crashes from other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-11941 Quiche Use-After-Free Attempt"; flow:to_server; content:"quiche_connection_id_iter_next"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade quiche: Update to version 0.29.2 or later.
2. Disable FFI feature: If the FFI API is not required, disable the ffi feature flag in the build configuration.
3. Patch applications: Rebuild applications that use quiche FFI with the patched library.

Long-term Mitigations:

• Code Review: Review all FFI functions for proper memory management.
• Static Analysis: Use Rust's safety guarantees and tools like cargo audit to detect similar issues.
• Memory Safety: Consider using Rust's safe abstractions instead of raw FFI where possible.

Workarounds:

• If upgrading is not immediately possible, avoid calling the vulnerable functions or ensure the returned pointer is not dereferenced.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert