Microsoft has released an urgent out-of-band security update for .NET, covering versions 8, 9, 10, and the release candidate 11 RC3, in response to a critical buffer overflow vulnerability (CVE-2026-111497) in the Brotli decompression algorithm. This flaw is rated CVSS 10 and poses risks such as information disclosure and remote code execution, affecting applications that handle Brotli data. Additionally, the update addresses two previously incomplete fixes for memory corruption and remote code execution vulnerabilities, as well as a privilege escalation issue related to Linux tarballs. Developers are urged to promptly apply these updates before the end-of-support deadline for .NET 8 and 9 on November 10, 2026

Microsoft .NET Out-of-Band Update: Fix Critical CVE-2026-111497 Brotli Flaw Now

Microsoft issued an out-of-band .NET security update on today, covering .NET 8, 9, 10, and .NET 11 RC3, and is urging developers to patch immediately. The headline fix addresses CVE-2026-111497, a CVSS 10 buffer overflow in Brotli decompression that simultaneously hit Node.js. The release also re-releases two incomplete fixes for a SocketAsyncEventArgs memory corruption bug and a Blazor WebAssembly debugger RCE, plus adds a Linux tarball ownership fix. Timing is especially urgent: .NET 8 and 9 hit end-of-support on November 10, and .NET 11 goes GA around the same date.

Microsoft .NET Out-of-Band Update: Fix Critical CVE-2026-111497 Brotli Flaw Now @ NT Compatible