Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
9 stories, newest first · one card per story
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.

JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
Development snapshot N-119856-gbe46370941 is affected; CISA-ADP scores remote unauthenticated denial of service at CVSS 7.5.
Ubuntu's USN-8915-1 fixes FFmpeg flaws, including possible code execution and several denial-of-service bugs.

Launchvideo uses Claude Opus 5.5 in a serverless agent to render explainer MP4s from a URL or prompt.
Ubuntu USN-8750-1 fixes multiple FFmpeg memory-handling flaws that allow denial of service via crafted files.
Ubuntu issued USN-8716-2 fixing FFmpeg VobSub, Vulkan HEVC, and NVDEC decoder flaws that could allow denial of service or code execution.
Ubuntu's USN-8738-1 fixes multiple FFmpeg vulnerabilities allowing denial of service, arbitrary code execution, and sensitive information exposure.
Simon Willison built a browser-based video compressor using the WebAssembly FFmpeg build, generated by Claude Fable 5.1 in Claude Code for web.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views