Microsoft has shipped emergency security updates for .NET to close a memory-safety hole in the Brotli decompression code the platform uses. The fixes arrived on 25 October as out-of-band releases, outside the normal monthly patch cycle.
The bug, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder. Microsoft’s advisory rates it High, with a CVSS 3.1 score of 8.1, and says an unauthenticated attacker could read or corrupt process memory. Microsoft lists information disclosure, a crash or elevated privileges as possible outcomes.
Only apps that decompress untrusted Brotli data are exposed
The flaw, per Microsoft’s advisory, touches .NET 8, 9, 10 and the .NET 11 release candidate on every platform. The older .NET Framework is not affected.
Microsoft says ASP.NET Core request decompression and automatic response decompression in HttpClient are off by default. An app is at risk only if it decompresses Brotli data an attacker can control, either through those features or by calling BrotliStream or BrotliDecoder directly.
Versions that carry the fix
The release announcement lists the patched runtimes below.
| .NET | Patched runtime |
|---|---|
| 8 | 8.0.33 |
| 9 | 9.0.22 |
| 10 | 10.0.14 |
| 11 (release candidate) | 11.0.0-rc.3.26522.148 |
For most projects, installing the new runtime or SDK and restarting the app is enough. Self-contained apps must be rebuilt and redeployed. NativeAOT apps need the updated SDK and a fresh publish, because updating the shared runtime on a machine does not change a decoder already compiled into the executable.
A stopgap if you cannot update today
Microsoft’s interim advice is to stop decompressing untrusted Brotli data. In ASP.NET Core you can remove the “br” provider from the decompression options, and in HttpClient you can limit automatic decompression to GZip and Deflate. The advisory warns against switching on decompression features an app does not already use, since that can add denial-of-service risk.
The weak spot is Brotli itself
The weakness sits in the Brotli decoder library, so .NET is not the only software affected. A 23 October notice on the oss-security mailing list, for example, covers a Perl module that bundles the vulnerable decoder and was fixed by moving to Brotli 1.2.1.
The same .NET release also corrects two earlier fixes from 13 October that turned out to be incomplete, and a Linux archive ownership issue.
