In an unexpected Sunday move, Microsoft rushed out an emergency out-of-band security patch following the verification of a severe vulnerability residing within the Google Brotli decompression algorithm. The flaw heavily affects .NET versions 8, 9, 10, and .NET 11 Release Candidate 3, spanning Windows, macOS, and Linux operating environments.

Rahul Bhandari, a senior program manager overseeing Microsoft .NET, revealed in an October 25 advisory that the security hole was pinpointed on October 22. Classified as a buffer overflow defect, it gives an unauthenticated hacker the capability to read or tamper with process memory. Potential fallout ranges from unauthorized information disclosure and system denial of service to full privilege escalation.

Official documentation within the Common Vulnerabilities and Exposures database, logged under CVE-2026-111497, warns that successful exploitation could trigger the execution of arbitrary code via a maliciously crafted Brotli-compressed stream.

Microsoft Confirms Impact of CVE-2026-111497

The Microsoft Security Response Center verified that the issue is publicly documented and carries a critical severity rating. Although active exploitation has not been observed in the wild, the MSRC assessment flags exploitation as being more likely to occur.

Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs, cautioned Bhandari, urging prompt updates.

Engineers should note that automatic response decompression and request decompression remain disabled by default, and legacy .NET Framework installations are completely safe from CVE-2026-111497.

Microsoft Advice For Updating Applications And Build Environments

  • Framework-dependent applications: Deploy the latest runtime corresponding to your target .NET version, followed by an application restart.
  • Self-contained applications: Recompile and republish using the updated runtime, noting that installing a newer host runtime does not patch bundled runtimes.
  • Containers: Rebuild and push new deployments utilizing updated .NET container images.
  • Source-build consumers: Acquire the fresh source-build artifacts for your specific .NET version and rebuild packages to integrate the necessary tarball ownership fix.
  • ASP.NET Core tarball users (.NET 8 and 9): Apply updates using the refreshed ASP.NET Core Runtime tarballs, even when bypassing Microsoft .NET source builds.