Microsoft Rushes Out-of-Band Security Fixes for Critical .NET Brotli Vulnerability
Microsoft has released urgent out-of-band security updates for .NET 8, 9, 10, and 11, addressing a critical buffer overflow in the Brotli decompression algorithm and other significant flaws. Learn what developers need to do now.
In an urgent move to safeguard developers and applications, Microsoft has issued out-of-band (OOB) security updates for multiple versions of its .NET platform. Released on October 25, 2026, these critical patches address a severe buffer overflow vulnerability within the Brotli decompression algorithm (CVE-2026-111497), alongside a Linux .NET tarball ownership flaw (CVE-2026-114148) and re-releasing fixes for previously unresolved issues. The rapid deployment underscores the severity of these vulnerabilities and the potential risks they pose to information disclosure, denial of service, or even elevation of privilege for affected systems. Developers are strongly advised to apply these updates immediately to mitigate potential exploitation.
1. Understanding the Critical Brotli Decompression Vulnerability
At the forefront of this emergency release is CVE-2026-111497, a buffer overflow vulnerability found in .NET's implementation of the Brotli decompression algorithm. This flaw affects .NET versions 8, 9, 10, and 11 across all supported operating systems. A successful exploit could allow an unauthenticated attacker to read or corrupt process memory, potentially leading to information disclosure, denial of service, or elevation of privilege. The vulnerability has been rated as 'Critical' by Microsoft, with a CVSS score of 9.2, indicating a high potential for exploitation.
The Brotli algorithm, developed by Google in 2015, is widely used to speed up compression for web content, making this vulnerability particularly concerning due to its pervasive use. Applications are susceptible if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or directly via the System.IO.Compression.Brotli APIs. It's important to note that request decompression and automatic response decompression are not enabled by default, which might limit the immediate attack surface for some applications, but manual invocation of Brotli APIs still poses a risk. This also means that developers explicitly using Brotli in their applications need to be especially vigilant. Users of Google Brotli versions 1.0.3 through 1.2.0 are also advised to update their Brotli libraries or binaries to the latest available version.
2. Additional Security Fixes and Previously Unaddressed Issues
Beyond the critical Brotli flaw, this out-of-band update package also addresses CVE-2026-114148, a Linux .NET tarball ownership vulnerability. This particular flaw could allow a local attacker to modify files and gain elevated privileges due to unsafe ownership metadata within affected .NET tarballs. For .NET 8 and .NET 9, this affects ASP.NET Core distributions obtained through tarballs, including users who do not build .NET from source. For .NET 10 and .NET 11, the vulnerability primarily impacts source-build tarballs.
Furthermore, Microsoft has taken this opportunity to re-release advisories and provide comprehensive fixes for two vulnerabilities that were not fully addressed in the earlier October 13, 2026, Patch Tuesday rollout. These include CVE-2026-70197, a SocketAsyncEventArgs memory corruption issue, and CVE-2026-102870, related to the Blazor WebAssembly debugger. The re-release of these fixes highlights the ongoing commitment to ensuring the stability and security of the .NET ecosystem, emphasizing that even seemingly resolved issues require thorough verification. Developers who applied the initial October 13th patches for these specific CVEs should re-apply the latest updates to ensure complete protection.
3. Impact and Developer Action Required
The implications of these vulnerabilities are significant, ranging from potential data breaches and system instability to unauthorized privilege escalation. For developers, immediate action is paramount. Microsoft strongly recommends updating all affected .NET installations as soon as possible.
- Framework-dependent applications: Install the updated runtime for the specific .NET version your application targets, then restart the application.
- Self-contained applications: These applications require a rebuild and republish with the updated runtime to incorporate the fixes.
- Containerized applications: Rebuild and redeploy your containers using the updated .NET container images.
- Source-build consumers: Obtain the updated source-build artifacts for your .NET version and rebuild your packages to integrate the tarball ownership fix.
- ASP.NET Core tarball users on .NET 8 and .NET 9: Update your installation using the refreshed ASP.NET Core Runtime tarball for your respective .NET version.
The .NET Framework is explicitly stated as not being affected by these particular vulnerabilities. However, developers should always ensure all components of their software stack are up-to-date. This out-of-band release serves as a crucial reminder for all developers to stay informed about security advisories and maintain a robust patching strategy.
Comparison Overview
| Vulnerability (CVE) | Description | Affected .NET Versions | Impact | Action Required |
|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Brotli decompression algorithm. | 8, 9, 10, 11 (All Platforms) | Information disclosure, Denial of Service, Elevation of Privilege (Critical CVSS 9.2) | Install updated runtime, rebuild/republish apps, update containers. |
| CVE-2026-114148 | Unsafe ownership metadata in Linux .NET tarballs. | 8, 9, 10, 11 (Linux) | Local Privilege Elevation | Update source-build artifacts, update ASP.NET Core tarballs (for 8 & 9). |
| CVE-2026-70197 (Re-release) | SocketAsyncEventArgs memory corruption. | 8, 9, 10, 11 | Remote Code Execution (Important) | Ensure latest OOB update is applied. |
| CVE-2026-102870 (Re-release) | Blazor WebAssembly debugger vulnerability. | 10, 11 | Remote Code Execution (Important) | Ensure latest OOB update is applied. |
Frequently Asked Questions (FAQ)
Q: What is an out-of-band (OOB) security update?
An out-of-band (OOB) security update is a patch released outside of a vendor's regular, scheduled update cycle. It indicates that a critical vulnerability has been discovered that requires immediate attention to prevent widespread exploitation, thus necessitating a faster release to protect users.
Q: How do I know if my .NET application is affected by the Brotli vulnerability?
Your application may be affected if it processes Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or directly uses the System.IO.Compression.Brotli APIs. While request and automatic response decompression are not enabled by default, any explicit use of Brotli APIs makes your application vulnerable without the patch.
Q: Does this update affect .NET Framework applications?
No, Microsoft has explicitly stated that the .NET Framework is not affected by these specific out-of-band security updates. These patches are for .NET 8, 9, 10, and 11.
Q: What steps should I take if I use .NET in a containerized environment?
If you are running .NET applications in containers, you must rebuild and redeploy your container images using the updated .NET container images provided by Microsoft. This ensures that the patched runtimes are included in your deployment.
Try Our Developer Utilities
Simplify your engineering workflows with our free browser-native tools: