Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
Original title: Microsoft releases emergency .NET security fixes for Google Brotli bug
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
Microsoft released out-of-band updates for .NET 8, 9, 10, and .NET 11 after a buffer overflow in Google's Brotli library, CVE-2026-111497, rated 8.1. An unauthenticated attacker who supplies malicious Brotli-compressed data can read or corrupt process memory, potentially causing information disclosure, denial of service, or elevation of privilege. Node.js, Python, Bun, Envoy, and Istio have also patched; JFrog demonstrated an FFmpeg path via a crafted JPEG XL image, and researchers said Apache Arrow can be crashed. Microsoft says exploitation is more likely but has no evidence of successful criminal use. OpenAI advises blocking untrusted Brotli data until deployments are rebuilt and restarted.
Unconfirmed: Microsoft says working exploits exist and exploitation is more likely, but it has no evidence criminals are using them successfully.
- Microsoft's advisory rates CVE-2026-111497 at 8.1 under CVSS v3.1.
- Node.js disclosed the issue on October 21 and credited OpenAI Codex Security researchers.
- The underlying Brotli bug was fixed in source in February but not then treated as a vulnerability.
- Wiz said 91 percent of cloud environments use vulnerable components.
- JFrog's FFmpeg path uses libjxl and brob metadata boxes in JPEG XL.
Impact: Read or corrupt process memory, leak data, crash, or elevate privileges
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft .NET | .NET 8, 9, 10, and .NET 11 | out-of-band security updates |
| Google Brotli | — | — |
| Node.js | — | — |
| FFmpeg | — | — |
| Apache Arrow | — | — |
- 1.Install Microsoft's out-of-band .NET updates as soon as possible.
- 2.Block untrusted Brotli-compressed data until patches are applied.
- 3.Rebuild affected deployments and restart services so fixes take effect.
- CVEs
- CVE-2026-111497
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at theregister.comRedmond joins growing list of software maintainers scrambling to patch compression flaw
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.