Microsoft Rushes Out Fix for High-Severity .NET Brotli Vulnerability

Developers and administrators should check affected .NET installations now and deploy Microsoft’s out-of-band updates as soon as possible. Released on October 25, 2026, the patches address the .NET Brotli vulnerability tracked as CVE-2026-111497, which can corrupt memory when vulnerable code decompresses specially crafted Brotli data. Production runtimes, containers, self-contained applications, NativeAOT builds, CI/CD systems, and deployment images all require review.

Microsoft assigned CVE-2026-111497 a CVSS 3.1 score of 8.1 and a High severity rating. Although the risk may be described editorially as critical because of its potential consequences, Microsoft does not formally classify it as a Critical vulnerability. The official advisory says successful exploitation may allow an unauthenticated attacker to read or corrupt process memory, potentially leading to information disclosure, denial of service, or elevation of privilege. It does not establish that arbitrary code execution is guaranteed or that attacks have been observed in the wild.

Why Microsoft Released an Out-of-Band .NET Security Update

The Microsoft .NET security update arrived outside the normal monthly servicing schedule, making it an out-of-band release. Microsoft uses such releases when it determines that supported systems should receive a security correction without waiting for the next scheduled update cycle.

CVE-2026-111497 was disclosed on October 25, 2026, and affects relevant modern .NET runtime and NativeAOT packages. The issue is documented in Microsoft’s official dotnet/runtime security advisory. As of publication, the advisory does not report confirmed exploitation in the wild. Teams should distinguish Microsoft’s description of possible impact from a demonstrated exploit or proof of reliable remote code execution.

How the .NET Brotli Vulnerability Works

Brotli is a compression algorithm used to reduce the size of content transmitted over networks or stored on disk. A decoder reverses that process by turning compressed input back into its original form. Applications may use Brotli for HTTP traffic, uploaded files, stored objects, or application-specific data formats.

The flaw is an out-of-bounds write in the Brotli decoder. When vulnerable code processes specially crafted compressed data, a decoding operation can write outside its intended memory boundary. This makes CVE-2026-111497 a .NET buffer overflow vulnerability as well as a Brotli decompression vulnerability.

Malformed input becomes particularly dangerous when it comes from an untrusted user, remote service, uploaded file, or other attacker-influenced source. According to Microsoft, resulting memory corruption could expose information, crash the process, or potentially support elevation of privilege. Actual exploitability depends on the application’s code paths, hosting model, enabled features, platform, and configuration.

Memory corruption does not automatically mean an attacker can execute arbitrary code, bypass authentication, or compromise every application running .NET. An application must reach the vulnerable decoder with attacker-controlled Brotli input. That qualification is essential when assessing this Brotli decoder vulnerability.

Affected and Patched .NET Versions

The versions below are those identified in Microsoft’s advisory and applicable release information as of October 26, 2026. Organizations should verify them against the current release notes immediately before deployment, because servicing guidance can be revised.

SDK and runtime numbers are intentionally different. The SDK is used to build applications, while the runtime executes framework-dependent applications. Install the package appropriate to the build or deployment model rather than comparing unlike version numbers.

The .NET Framework is not affected by this advisory. The .NET Framework is a separate product from modern .NET releases such as .NET 8, .NET 9, and .NET 10.

Which Applications Are Practically Exposed?

Having an affected runtime installed does not automatically make an application reachable through this flaw. Practical exposure depends on whether the application uses a vulnerable decoder to process attacker-controlled Brotli data. Microsoft’s advisory identifies three principal paths:

• ASP.NET Core request decompression: An application enables request decompression and includes Brotli support, allowing compressed request bodies to reach the decoder.
• Automatic HttpClient response decompression: An application configures HttpClientHandler.AutomaticDecompression or SocketsHttpHandler.AutomaticDecompression to accept Brotli responses from a remote endpoint.
• Direct compression APIs: Application code uses BrotliStream, BrotliDecoder, or related System.IO.Compression functionality with untrusted input.

According to the advisory, ASP.NET Core request decompression and automatic HttpClient response decompression are not enabled by default. Those defaults reduce exposure for some services, but they do not protect custom implementations or applications that explicitly enable the features. ASP.NET Core security reviews should therefore examine configuration and data flow rather than relying only on package inventories.

How to Check and Patch Your .NET Installation

Start by inventorying installed SDKs and runtimes. Run these commands on developer workstations, servers, build agents, and other relevant hosts:

dotnet --list-sdks
dotnet --list-runtimes
dotnet --version

Each command answers a different question. dotnet --list-sdks lists installed SDKs, while dotnet --list-runtimes lists shared runtimes available on that system. dotnet --version reports the SDK selected in the current context, which may be influenced by a project’s global.json file.

An updated SDK on a developer’s workstation does not prove that a deployed service uses a patched runtime. Inspect the actual runtime selected in production, container base and final images, CI/CD pipelines, build agents, package references, and published application artifacts.

1. Identify the application’s .NET release line and deployment model.
2. Determine whether it processes untrusted Brotli data through one of the relevant paths.
3. Obtain the applicable update from the official .NET download page and consult the release notes for that version.
4. Update runtime packages, SDKs, container images, or explicit runtime-pack references as required.
5. Rebuild and republish application artifacts when the runtime is bundled with them.
6. Deploy in stages where practical, then validate application health and affected workflows.

The .NET security patch October 2026 should be treated as a component replacement exercise, not merely a workstation update. Confirm that the patched decoder reaches the final production artifact.

Temporary Mitigations When Immediate Patching Is Impossible

Microsoft’s primary mitigation is to avoid decompressing attacker-controlled Brotli data until the security update is installed. The patched runtime or package remains the recommended fix.

• If an application already enables ASP.NET Core request decompression with Brotli, temporarily remove the br provider from its existing configuration.
• If an existing HttpClient handler enables automatic decompression, exclude Brotli from the configured decompression flags while retaining other formats the application requires.
• If application code directly uses BrotliStream, BrotliDecoder, or related APIs, do not pass untrusted Brotli input to them until the application is updated.

Do not introduce new decompression settings merely to apply a mitigation. Configuration changes can alter interoperability, uploads, requests, or integration behavior and should be tested before production deployment. These measures reduce exposure but are not substitutes for the .NET runtime update.

Containers, Self-Contained Apps, and NativeAOT Need Extra Work

A shared-runtime update can protect compatible framework-dependent applications using that installed runtime. It does not automatically repair applications that carry their own runtime.

Self-contained deployments must be rebuilt and redeployed with the patched runtime. Updating only the host’s shared runtime is insufficient because the vulnerable component remains bundled in the published application.

NativeAOT applications require similar attention because decoder code may be linked into the executable. Update the SDK and any explicit compiler or runtime-pack references, then republish and redeploy the resulting binary. Merely patching the build host after an executable has already been produced does not change that artifact.

Containerized teams should verify both build and runtime stages, refresh applicable base images, rebuild without reusing stale layers where necessary, and inspect the final image. After rollout, run health checks and regression tests covering HTTP calls, compression, request uploads, file processing, and any custom Brotli workflows.

Developer and Operations Checklist

• Inventory production runtimes, SDKs, containers, and application artifacts.
• Review whether untrusted Brotli input reaches a vulnerable decoder.
• Install the patched version for each supported .NET line.
• Rebuild self-contained and NativeAOT applications.
• Redeploy containers and verify the final runtime version.
• Test compression-dependent workflows and monitor service health.

A Separate Linux Tarball Issue Was Also Fixed

The October 25 out-of-band release also addresses CVE-2026-114148, an issue involving Linux .NET tarball ownership in applicable .NET 8, 9, 10, and 11 distributions. That correction is separate from CVE-2026-111497 and should not be confused with the Brotli memory-corruption flaw.

Frequently Asked Questions

What is CVE-2026-111497?

It is a high-severity out-of-bounds write in the .NET Brotli decoder. Specially crafted compressed input may cause memory corruption, with potential consequences including information disclosure, denial of service, or elevation of privilege. Microsoft assigned it a CVSS 3.1 score of 8.1.

Which .NET versions are affected?

Affected releases include .NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14, and .NET 11 previews before 11.0.0-rc.3.26522.148. Use a patched release in the relevant supported servicing line.

Is .NET Framework affected?

No. Microsoft’s advisory states that the .NET Framework is not affected. It should not be confused with modern .NET releases.

Does every ASP.NET Core application have the vulnerability?

No. Exposure depends on whether vulnerable code decompresses attacker-controlled Brotli input. Request decompression is not enabled by default, but applications that enable Brotli support or directly use Brotli APIs must be assessed.

How can developers check their installed runtime?

Run dotnet --list-runtimes to view shared runtimes and dotnet --list-sdks to view SDKs. Use dotnet --version to identify the SDK selected for the current project, remembering that this does not prove which runtime a deployed application uses.

Does updating the shared runtime fix self-contained or NativeAOT apps?

No. Self-contained and NativeAOT applications must be rebuilt, republished, and redeployed using patched tooling and runtime components because affected code may be included in the application artifact.

What should teams do if they cannot patch immediately?

Avoid decompressing attacker-controlled Brotli data. Where already configured, remove Brotli from ASP.NET Core request decompression or HttpClient automatic decompression, and keep untrusted data away from direct Brotli APIs. Test behavioral changes and deploy the official patch as soon as possible.