Microsoft Rushes Out.NET Patches for Four Flaws Including Brotli Overflow

First reported 26 Oct, 07:18 UTCSource: GBHackersLast editorial activity 26 Oct, 07:18 UTCWrite a comment ↓

A vibrant red love padlock with heart engravings on a bridge railing symbolizing eternal love. — Illustrative photo.Photo by Pixabay on PexelsMicrosoft logo shown for identification only; no affiliation with or endorsement of WORLDTECH is implied.

Microsoft has issued unscheduled security updates for .NET that address four vulnerabilities, among them a buffer overflow in Brotli decompression and shortcomings left behind by an earlier October release. The company urges customers to install them without delay.

The Brotli buffer overflow

The most serious of the four is CVE-2026-111497, which touches .NET's handling of Brotli decompression on every platform. According to the report, the buffer overflow could allow an unauthenticated attacker to read or tamper with process memory, with information disclosure, denial of service and privilege escalation named as possible outcomes.

Exposure depends on how applications use the feature. Those that handle Brotli-compressed data through ASP.NET Core request decompression, automatic response decompression in HttpClient, or the Brotli APIs in System.IO.Compression are at risk. Request decompression and automatic response decompression are switched off by default, which limits the number of applications that are affected.

Linux tarballs and local privilege risk

A second flaw, CVE-2026-114148, lies in unsafe ownership metadata carried by .NET tarballs for Linux. A local attacker could abuse affected installations to alter files and obtain higher privileges.

Impact varies by version. On .NET 10 and .NET 11 the problem is limited to source-build tarballs. On .NET 8 and .NET 9 it extends to ASP.NET Core distributions installed from ASP.NET Core tarballs, which matters for deployments that do not compile .NET from source.

Earlier October fixes fell short

Microsoft also reissued two advisories because the updates it released on October 13, 2026 did not fully remove the underlying flaws. CVE-2026-70197 involves memory corruption in SocketAsyncEventArgs and affects .NET 8, .NET 9, .NET 10 and .NET 11. CVE-2026-102870 concerns the Blazor WebAssembly debugger and affects .NET 10 and .NET 11. According to the report, the latest releases now contain fixes for both.

Open questions

Which customers run the affected Brotli features in production?

Key facts

Microsoft released emergency out-of-band security updates covering four vulnerabilities in .NET.

The updates close a Brotli buffer overflow and gaps left by an earlier October release.

The updates apply to .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3.

Microsoft has confirmed that the issue does not affect the .NET Framework.

Microsoft recommends installing the updates as soon as possible.