Microsoft Releases Emergency .NET Security Update for Critical Brotli Vulnerability

Microsoft has released an emergency security update for .NET after discovering a critical vulnerability in its use of the Brotli decompression algorithm. The flaw could allow an unauthenticated attacker to read or corrupt application memory, potentially leading to information disclosure, denial of service, or privilege escalation.

Announced on October 25, 2026, the out-of-band update covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. The vulnerability, tracked as CVE-2026-111497, affects Windows, macOS, and Linux platforms.

Microsoft is urging developers to install the relevant security updates as soon as possible. The company has also released a separate fix for a Linux .NET tarball ownership issue in the same update package.

What Is CVE-2026-111497?

The security flaw involves a buffer overflow in .NET's use of Google's Brotli decompression algorithm. Brotli is a compression technology used to reduce data sizes and improve data transfer efficiency.

According to Microsoft's security advisory, a specially crafted Brotli-compressed stream could trigger memory-related problems when processed by a vulnerable application. Depending on the circumstances, an attacker could potentially access or corrupt process memory, disrupt an application, or gain elevated privileges.

The vulnerability is particularly relevant to applications that process compressed data from potentially untrusted sources.

Microsoft says affected applications may include those using Brotli through three main pathways:

• ASP.NET Core request decompression: Applications that decompress incoming HTTP request bodies.
• HttpClient automatic response decompression: Applications that automatically decompress compressed server responses.
• System.IO.Compression Brotli APIs: Software that directly uses .NET's Brotli compression and decompression functionality.

Microsoft notes that request decompression and automatic response decompression are not enabled by default. However, developers should still review their application's configuration and update affected .NET installations.

Which .NET Versions Are Affected?

Microsoft's October 25 emergency release provides security fixes for the following versions:

The updates address the Brotli vulnerability across supported platforms. Microsoft also says .NET Framework is not affected by CVE-2026-111497.

Developers should use the official Microsoft release announcement to identify and download the appropriate update for their environment.

Official update: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

Has the Vulnerability Been Exploited?

Microsoft has rated CVE-2026-111497 as a critical security issue and has urged customers to update promptly. Its published guidance indicates that exploitation is considered more likely, but the company reported no evidence of exploitation at the time of its announcement.

The absence of confirmed attacks does not eliminate the risk. Applications that handle compressed data should be reviewed, particularly when that data originates from external users or services.

Security teams should also monitor Microsoft's advisory for any new information about exploitation, affected configurations, and mitigation guidance.

How Developers Should Install the Emergency .NET Patch

The correct update procedure depends on how an application is deployed. Updating a development computer alone may not be enough to protect applications already running in production.

1. Framework-dependent applications

Install the updated runtime for the .NET version targeted by the application, then restart the application so it uses the patched runtime.

Developers can check the installed runtimes by running:

dotnet --list-runtimes

Confirm that the appropriate updated version is installed.

2. Self-contained applications

Self-contained deployments include their own .NET runtime. Installing a newer runtime separately on the host does not automatically update the runtime bundled with the application.

Developers should rebuild and republish these applications using the updated runtime, then deploy the new packages.

3. Applications running in containers

Teams using Docker or other container-based deployments should rebuild and redeploy their applications with updated .NET container images.

Simply updating the host machine may leave the vulnerable runtime inside an existing container image.

4. Source-build environments

Organizations that build .NET from source should obtain the updated source-build artifacts and rebuild their packages to include the relevant fixes.

Microsoft also provides specific guidance for users of ASP.NET Core runtime tarballs on .NET 8 and .NET 9. These users should install the refreshed tarball even if they do not build .NET from source.

Microsoft Also Fixes a Linux Tarball Ownership Issue

The October 25 release includes another security fix, tracked as CVE-2026-114148, involving unsafe ownership metadata in certain Linux .NET tarballs.

According to Microsoft, this issue could allow a local attacker to modify files and gain elevated privileges under affected conditions.

The fix applies to particular distribution methods and builds. Microsoft says the issue affects source-build tarballs for .NET 10 and .NET 11, while certain ASP.NET Core tarball distributions for .NET 8 and .NET 9 are also affected.

Developers should check the official advisory to determine whether their installation method requires additional action.

Why the Emergency Update Matters

The Brotli vulnerability highlights the importance of keeping application runtimes and deployment images up to date. Compression features can improve performance, but software that processes compressed input must handle that data securely.

For development teams, the key steps are to identify the .NET versions in use, determine how applications are deployed, install the appropriate fixes, and restart or redeploy affected services.

Bottom line: Microsoft recommends updating affected .NET installations as soon as possible. Developers should follow the official release guidance rather than assuming that updating the host computer automatically patches self-contained applications or existing containers.

Sources: Microsoft .NET security update announcement | Microsoft Security Response Center