Microsoft Releases Out-of-Band Emergency .NET Security Updates for Critical Brotli Decoder Vulnerability

Microsoft has released emergency out-of-band security updates for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. The updates address multiple security vulnerabilities, including a Brotli decompression flaw that could expose process memory. Microsoft recommends installing the updates as soon as possible.

Microsoft fixes dangerous .NET security vulnerabilities

The latest release addresses CVE-2026-111497, a buffer overflow vulnerability affecting .NET’s use of the Brotli decompression algorithm. Microsoft says an unauthenticated attacker could exploit the flaw to read or corrupt process memory.

Depending on the circumstances, successful exploitation could lead to information disclosure, denial of service, or privilege escalation. The vulnerability affects all platforms, making the update particularly important for developers handling compressed data.

Applications could be affected when using ASP.NET Core request decompression, automatic response decompression through HttpClient, or the System.IO.Compression Brotli APIs. However, request and automatic response decompression are disabled by default.

Microsoft also addresses CVE-2026-114148, involving unsafe ownership metadata in affected Linux .NET tarballs. A local attacker could potentially modify files and gain elevated privileges. The company has also reissued advisories for two previously addressed vulnerabilities. These include CVE-2026-70197, involving SocketAsyncEventArgs memory corruption, and CVE-2026-102870, affecting the Blazor WebAssembly debugger. Microsoft says the October 13 release did not fully resolve these issues.

Download the latest .NET security updates

Developers can download the updated SDKs and runtimes from Microsoft’s official website. The latest versions include .NET 8.0.33, .NET 9.0.22, and .NET 10.0.14. Meanwhile, .NET 11 users should install Release Candidate 3.

Microsoft recommends different update steps depending on the deployment type. Framework-dependent applications need the updated runtime installed, followed by an application restart. Self-contained applications must be rebuilt and republished with the updated runtime.

Container deployments also require rebuilding and redeploying with updated .NET container images. Developers using affected source-build packages or ASP.NET Core tarballs must obtain the refreshed artifacts.