Microsoft has released out-of-band security updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3 that fix CVE-2026-111497, a buffer overflow in .NET’s use of the Brotli decompression algorithm.
The .NET team’s October 25 release post says the flaw may allow an unauthenticated attacker to read or corrupt process memory, which could lead to information disclosure, denial of service or elevation of privilege on all platforms. Applications are exposed if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. The first two are not enabled by default, and .NET Framework is not affected. The fixed versions are 8.0.33, 9.0.22 and 10.0.14. The same release fixes CVE-2026-114148, a Linux tarball ownership flaw, and re-issues fixes for CVE-2026-70197 and CVE-2026-102870 because the October 13 updates did not fully address them.
Microsoft’s deployment guidance is where patch reporting can go wrong. Installing the new runtime on a host covers framework-dependent applications once they restart. Self-contained applications bundle their own runtime and must be rebuilt and republished, and containers must be rebuilt from updated .NET images. A host scan that shows 8.0.33 installed can therefore mark a service as fixed while the binary it runs still carries the old code.
In our reading, the first triage question is which services accept compressed request bodies or turn on automatic response decompression, since those are the paths the advisory names. Then rebuild every self-contained and container workload, and confirm the bundled runtime version in the artifact itself. Re-issued fixes are not new for Microsoft: September’s record Patch Tuesday was followed by an emergency fix too. Language runtimes have drawn several advisories this month, including the PHP advisory for CVE-2026-115560.
Source: Microsoft .NET Blog, .NET October 2026 out-of-band security updates, Oct. 25, 2026
