Microsoft ships out-of-band .NET fixes for Brotli and Linux tarball flaws
Original title: Microsoft Releases Out-of-Band Security Updates for Brotli and .NET tarballs Vulnerability
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3; .NET Framework is not affected.
Microsoft published out-of-band .NET updates on October 25, 2026, covering .NET 8, 9, 10, and .NET 11 Release Candidate 3. CVE-2026-111497 is a Brotli buffer overflow that could let an unauthenticated attacker read or corrupt process memory, with possible data exposure, crashes, or elevated privileges. CVE-2026-114148 concerns unsafe ownership metadata in Linux .NET tarballs that a local attacker could use to modify files and gain higher privileges. The release also completes fixes for CVE-2026-70197 and CVE-2026-102870 that the October 13 update did not fully resolve.
Unconfirmed: Microsoft does not say whether any of the four vulnerabilities has been exploited.
- Request and automatic response decompression are not enabled by default.
- For .NET 10 and 11, the tarball flaw affects source-build archives only.
- For .NET 8 and 9, ASP.NET Core tarball installations also need refreshed archives.
- Self-contained apps and containers must be rebuilt; a newer host runtime is not enough.
- Users on .NET 11 RC2 should move to Release Candidate 3.
Impact: Memory read or corruption, or local privilege gain on Linux
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft .NET | .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 2 | .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, .NET 11 Release Candidate 3 |
- 1.Install .NET 8.0.33, 9.0.22, 10.0.14, or .NET 11 Release Candidate 3 and restart framework-dependent apps.
- 2.Rebuild and republish self-contained applications and redeploy containers from updated images.
- 3.Replace affected Linux source-build and, for .NET 8 and 9, ASP.NET Core tarballs.
- Vendors
- Microsoft
- Products
- .NETASP.NET CoreBrotli
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |
From the original article
2 min read at cybersecuritynews.com
Microsoft has released out-of-band security updates for . NET to fix a Brotli buffer overflow and unsafe ownership settings in Linux distribution archives. Published on October 25, 2026, the release covers .
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.