CVE-2026-111497, a critical buffer overflow flaw with a CVSS score of 9.2, prompted Microsoft to publish out-of-band .NET updates on October 25 to fix a Brotli decompression vulnerability that can let unauthenticated attackers read or corrupt process memory.
CVE-2026-111497 and Brotli decompression
Microsoft’s emergency update set addresses CVE-2026-111497 across .NET versions 8, 9, 10 and 11. The vulnerability is contained in the Brotli decompression algorithm used by .NET and "can allow an unauthenticated attacker to read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege," the advisory states. Microsoft said that applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs.
The advisory also points users to the Google Brotli implementation: "Users of Google Brotli versions 1.0.3 through 1.2.0 also need to update any Brotli libraries or binaries to the latest available version." The notice notes Brotli's origins, that it "was designed by two engineers at Google in 2015 to allow developers to speed up algorithm compression for developers," underscoring why the algorithm is widely present across runtimes and tooling.
CVE-2026-114148 and unsafe ownership metadata in .NET tarballs
Microsoft’s out-of-band release also remedied CVE-2026-114148, which can "allow an authorized attacker to elevate privileges locally by exploiting unsafe ownership metadata in affected .NET tarballs." The advisory says the flaw affects .NET versions 7–11, but with platform and distribution caveats: it affects only Linux systems; for .NET 10 and .NET 11 it affects source-build tarballs only; for .NET 8 and .NET 9 it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, "including users who do not build .NET from source."
At the time of the update the vulnerability had not been assigned a CVSS score but "has been reserved by a CVE Numbering Authority (CNA)," Microsoft noted.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRe-issued fixes: CVE-2026-70197 and CVE-2026-102870
Alongside the two newly disclosed issues, Microsoft re-issued fixes for two vulnerabilities first disclosed in its October 13 Patch Tuesday rollout. The reissued fixes cover CVE-2026-70197, described as a memory corruption flaw affecting .NET versions 8–11, and CVE-2026-102870, a code injection vulnerability affecting .NET 10 and 11. The out-of-band release bundles those corrections with the new Brotli and tarball ownership fixes.
Microsoft’s remediation guidance for .NET developers
Microsoft published concrete steps for developers and build environments to incorporate the fixes. The advisory lists actions to take depending on how applications are deployed:
- Install the updated runtime for the .NET version for your framework-dependent application, then restart the application.
- Rebuild and republish self-contained applications with the updated runtime.
- Rebuild and redeploy containers using updated .NET container images.
- Obtain the updated source-build artifacts for your .NET version and rebuild your packages to incorporate the tarball ownership fix.
- For ASP.NET Core tarball users on .NET 8 and 9, update your installation using the refreshed ASP.NET Core Runtime tarball for your .NET version.
Microsoft also noted that single updates are available for each of the affected .NET versions and that ".NET 11 RC2 users should update to RC3 to receive these fixes."
What this means for developers, enterprises, and open-source maintainers
- Developers and security teams: Update runtimes and rebuild self-contained apps and containers where applicable, and apply the refreshed ASP.NET Core Runtime tarballs if you're on .NET 8 or 9 and using tarball distributions.
- Enterprises and procurement leaders: Ensure runtime updates are rolled into CI/CD pipelines, container registries and image-building processes so production services do not continue running vulnerable Brotli decompression code.
- Open-source maintainers and library consumers of Brotli: Check Google Brotli versions — "Users of Google Brotli versions 1.0.3 through 1.2.0 also need to update" — and update Brotli libraries or binaries to the latest available release.
Microsoft’s October 25 out-of-band update bundles a high-severity, cross-platform memory-corruption risk in widely used compression code with a locally exploitable ownership-metadata issue on Linux, while reissuing earlier fixes. The practical takeaway in Microsoft’s advisory is procedural: install the updated runtimes, rebuild artifacts and containers as specified, and move .NET 11 RC2 deployments to RC3 to pick up the corrections. For organizations and maintainers who process Brotli-compressed data, the advisory leaves little ambiguity — apply the updates and refresh build artifacts promptly.