Microsoft issues emergency .NET fixes for Brotli memory flaw
The October 25 updates address a buffer overflow that could affect applications processing Brotli-compressed data. Microsoft rates exploitation more likely, but no attack has been reported.
Microsoft released emergency .NET security updates on October 25 to address CVE-2026-111497, a Brotli decompression buffer overflow that could put applications processing compressed data at risk. The fixes cover supported releases of .NET 8, 9 and 10, plus .NET 11 Release Candidate 3.
According to Microsoft's assessment reported by The Register and The Next Web, an unauthenticated attacker could read or corrupt process memory, potentially causing information disclosure, denial of service or elevation of privilege. Microsoft rates exploitation as more likely, while its advisory lists the flaw as publicly disclosed and not exploited. Neither outlet reported a known attack using it.
Which .NET applications may be exposed
Exposure depends on whether an application processes Brotli-compressed data through affected features. Cyber Security News identifies ASP.NET Core request decompression, automatic response decompression in HttpClient and the System.IO.Compression Brotli APIs as possible routes. The Next Web reports that Brotli decompression is not enabled by default in .NET and that .NET Framework is unaffected.
Cyber Security News lists the patched releases as .NET 8.0.33, 9.0.22 and 10.0.14, alongside .NET 11 Release Candidate 3. It says users of Release Candidate 2 need to move to RC3. For framework-dependent applications, installing the updated runtime and restarting the application are required for the fix to take effect.
Brotli fixes extend beyond .NET
The flaw is part of a wider round of Brotli-related updates. The Register reports that Node.js, Python and other projects issued fixes; The Next Web also identifies patched releases for Bun, Envoy, Istio and Python Brotli packages. The Next Web says Node.js and Google shipped fixed releases on October 21.
The Next Web reports that Microsoft's release also includes fixes for Visual Studio and PowerShell. Microsoft rates the flaw critical for .NET and Visual Studio, and important for PowerShell, according to the outlet. Cyber Security News says Microsoft also reissued fixes for two other vulnerabilities after its October 13 updates did not fully resolve them.
Read in depth: Technology
Apple releases iOS 27.2 with Apple Pencil support for iPhone Duo
The update adds support for the USB-C Apple Pencil on iPhone Duo, expands Siri AI language options and changes several iPhone apps.
Airbnb to bar hosts from requiring guests to wash dishes or take rubbish off-site
The revised house rules apply to reservations booked from November 20. Hosts can still ask guests to put dishes in the sink and sort rubbish into indoor bins.
Sources and context
- Microsoft releases emergency .NET security fixes for Google Brotli bugThe Register
- Microsoft Releases Emergency .NET Security Updates to Fix Brotli Memory Corruption FlawCyber Security News
- Microsoft patches critical Brotli flaw in .NET and Visual StudioThe Next Web
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.