Microsoft ships emergency .NET fixes for critical Brotli buffer overflow
Original title: Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
CVE-2026-111497, scored 9.2, can disclose information, crash the process, or elevate privilege.
Microsoft published out-of-band updates on October 25 for .NET 8, 9, 10, and 11 Release Candidate 3. They fix newly disclosed flaws and two issues not fully addressed in the October 13 Patch Tuesday. CVE-2026-111497 is a Brotli decompression buffer overflow affecting .NET 8 through 11 on all operating systems when apps process Brotli data. CVE-2026-114148 is a local privilege escalation via unsafe tarball ownership metadata on Linux. Google Brotli 1.0.3 through 1.2.0 also needs updating.
Unconfirmed: CVE-2026-114148 has not been assigned a CVSS score.
- Single updates cover each affected .NET version; .NET 11 RC2 users should move to RC3.
- CVE-2026-114148 affects .NET 7–11 on Linux and has no CVSS score yet.
- Reissued fixes cover CVE-2026-70197 on .NET 8–11 and CVE-2026-102870 on .NET 10 and 11.
- Apps using ASP.NET Core, HttpClient, or System.IO.Compression Brotli APIs may be affected.
Impact: Unauthenticated memory read or corruption, or local privilege elevation
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft .NET | 8, 9, 10, and 11, plus 7–11 on Linux for CVE-2026-114148 | .NET 11 RC3; updated runtimes for other versions |
| Google Brotli | 1.0.3 through 1.2.0 | latest available version |
- 1.Install the updated .NET runtime and restart framework-dependent applications.
- 2.Rebuild and republish self-contained apps and containers with the updated runtime.
- 3.Update Google Brotli libraries or binaries from 1.0.3 through 1.2.0.
- Products
- .NETBrotliASP.NET Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |
From the original article
2 min read at infosecurity-magazine.com
Microsoft’s updates address two newly disclosed vulnerabilities in the . NET developer platform, as well as flaws not fully addressed in an earlier release
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.