Microsoft Steps Outside Its Patch Schedule to Fix a .NET Compression Flaw
Microsoft released out-of-band security updates for .NET on Oct. 25, 2026, outside its usual monthly patch cycle, to fix a buffer overflow in the way the runtime unpacks Brotli, a compression format used to shrink web traffic. The company's release post says it recommends updating as soon as possible.
Microsoft's advisory table lists the flaw as CVE-2026-111497 and describes it as letting an unauthenticated attacker read or corrupt a program's memory, which the company says could lead to leaked information, a service knocked offline, or an attacker gaining higher privileges. That characterization is Microsoft's own; no independent assessment of the risk to running systems has been published.
According to the same post, an application is at risk only if it decompresses Brotli data, and Microsoft names three ways this happens: ASP.NET Core request decompression, automatic response decompression in HttpClient, and the System.IO.Compression Brotli APIs. The first two are not enabled by default. .NET Framework, the older Windows-only version, is not affected.
The fixed builds are 8.0.33 for .NET 8, 9.0.22 for .NET 9 and 10.0.14 for .NET 10, plus Release Candidate 3 for .NET 11. Microsoft says anyone on Release Candidate 2 should move to Release Candidate 3. Installing the new runtime on a machine does not update applications that bundle their own: self-contained applications have to be rebuilt and republished, and containers rebuilt and redeployed on updated images.
The same release fixes a second flaw, CVE-2026-114148, in the ownership data inside .NET's Linux tarballs, the archive files used to install it there. Microsoft says it could let someone with local access alter files and gain higher privileges. On .NET 10 and 11 only source-build tarballs are affected; on .NET 8 and 9 it also reaches installations made from ASP.NET Core tarballs.
Microsoft also re-issued two earlier advisories, CVE-2026-70197 for memory corruption in .NET's socket code and CVE-2026-102870 for the Blazor WebAssembly debugger, saying its Oct. 13, 2026, release did not fully fix either.
The same Brotli decoder flaw was reported earlier in October in the Brotli decoder packages distributed through PyPI, the Python package index.
