Microsoft has published out-of-band security updates for .NET to address a Brotli decompression buffer overflow and unsafe ownership metadata in Linux distribution archives.
Published October 25, 2026, the updates cover .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3. Microsoft is urging administrators and developers to apply the fixes as soon as possible.
The company’s announcement notes that these updates complete fixes for two vulnerabilities that were not fully resolved in the October 13 release, so teams that installed earlier .NET updates this month should still install the new patches.
The first issue, tracked as CVE-2026-111497, affects .NET’s use of Brotli decompression on all platforms. A buffer overflow in decompression code could allow an unauthenticated attacker to read or corrupt process memory, potentially leading to data exposure, application crashes or privilege escalation.
Applications are exposed when they process Brotli-compressed data via ASP.NET Core request decompression, HttpClient’s automatic response decompression, or the System.IO.Compression Brotli APIs.
Microsoft issues emergency Brotli and .NET updates
Microsoft emphasizes that ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. The older .NET Framework is not affected.
Because exposure depends on application configuration, teams should identify which services actually handle Brotli content rather than assume all .NET applications share the same risk.
The company previously disclosed a separate .NET denial-of-service vulnerability that raised availability concerns.
The second vulnerability, CVE-2026-114148, concerns unsafe ownership metadata in certain Linux .NET tarballs. Those archives include file ownership information and, according to Microsoft, the flaw could allow a local attacker to modify files and obtain elevated privileges. This issue is specific to Linux.
For .NET 10 and .NET 11 the problem affects source-build tarballs only. For .NET 8 and .NET 9 it also affects ASP.NET Core installations obtained through ASP.NET Core tarballs, so users in that group need refreshed archives even if they do not build .NET from source.
The release also completes fixes for CVE-2026-70197, a SocketAsyncEventArgs memory corruption issue, and CVE-2026-102870, a Blazor WebAssembly debugger vulnerability. CVE-2026-70197 affects .NET 8 through 11; CVE-2026-102870 affects .NET 10 and 11.
The patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3. Microsoft advises users running .NET 11 RC2 to upgrade to RC3. This emergency update follows prior servicing, including the .NET 10.0.7 security update.
Deployment requirements vary by application type. Framework-dependent applications require the updated runtime and an application restart. Self-contained applications must be rebuilt and republished because installing a newer host runtime does not replace the runtime bundled inside those apps. Container images must be rebuilt and redeployed using updated .NET images.
Source-build users should obtain refreshed artifacts and rebuild packages. Administrators can list installed runtimes with dotnet --list-runtimes, but they must verify self-contained applications and containers separately. Microsoft’s .NET deployment documentation explains these differences and helps teams select the correct update path for each application.
Give your SOC the alert context to stop incidents quickly. Integrate threat intel from 16K SOCs.
