Story perspectives

Microsoft Issues Emergency .NET Patch for Critical Brotli Flaw

By Drooid · Oct 26, 2026, 6:14 PM UTC · How we work

Summary

Story summary

Microsoft released an emergency out-of-band .NET update on Sunday to fix a critical Brotli vulnerability.
Senior program manager Rahul Bhandari announced the buffer-overflow bug on October 25, after its discovery on October 22.
CVE-2026-111497 could let an unauthenticated attacker read, corrupt memory, or execute code via a crafted Brotli stream.
Microsoft’s Response Center rates the flaw Critical (CVSS 8.1) and “Exploitation More Likely,” advises updating .NET 8-11 RC3 and rebuilding apps.

1 of 1

Story summary

Microsoft released an emergency out-of-band .NET update on Sunday to fix a critical Brotli vulnerability.
Senior program manager Rahul Bhandari announced the buffer-overflow bug on October 25, after its discovery on October 22.
CVE-2026-111497 could let an unauthenticated attacker read, corrupt memory, or execute code via a crafted Brotli stream.
Microsoft’s Response Center rates the flaw Critical (CVSS 8.1) and “Exploitation More Likely,” advises updating .NET 8-11 RC3 and rebuilding apps.