Microsoft issues emergency .NET fixes for four vulnerabilities
Original title: Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities
Patched builds are .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3, including a Brotli buffer overflow.
Microsoft released out-of-band updates for .NET 8, 9, 10, and 11 RC3. CVE-2026-111497 is an unauthenticated Brotli decompression buffer overflow that can read or corrupt process memory. Two fixes from October 13 were incomplete, and a Linux tarball ownership flaw can let a local attacker elevate privileges.
Unconfirmed: The advisory does not say whether any of the four flaws has been exploited.
- CVE-2026-111497 does not affect the .NET Framework; decompression features are off by default.
- CVE-2026-114148 affects Linux source-build tarballs and, on .NET 8 and 9, ASP.NET Core tarballs.
- CVE-2026-70197 is SocketAsyncEventArgs memory corruption on .NET 8 through 11.
- CVE-2026-102870 affects the Blazor WebAssembly debugger on .NET 10 and 11.
- Self-contained apps and containers must be rebuilt; a newer host runtime does not replace them.
Impact: Memory read or corruption, or local privilege escalation
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft .NET | .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 | .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3 |
- 1.Install .NET 8.0.33, 9.0.22, 10.0.14, or .NET 11 Release Candidate 3.
- 2.Rebuild and republish self-contained applications and container images.
- 3.Install refreshed ASP.NET Core runtime tarballs on .NET 8 and .NET 9.
- Vendors
- Microsoft
- Products
- .NETASP.NET Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102870 | Code injection in ASP.NET Core allows remote code execution | 8.8 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-114148 | Incorrect default permissions enable local privilege escalation in ASP.NET Core | 7.8 | — | ||
| CVE-2026-70197 | Out-of-bounds write enables remote code execution in .NET | 8.1 | — |
From the original article
2 min read at gbhackers.com
Microsoft released emergency out-of-band security updates addressing four vulnerabilities across . NET, including a Brotli buffer overflow and incomplete fixes from an earlier October release. The updates apply to .
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.