Full Breakdown
Microsoft Issues Emergency Out-of-Band Patch for Critical Brotli Decompression Vulnerability in .NET
By Drooid · · How we work
Core Event
On October 25, 2026, Microsoft released an emergency out-of-band update for the .NET platform after confirming a critical buffer-overflow flaw in the Google Brotli decompression algorithm. The vulnerability, identified on October 22, 2026, could allow an unauthenticated attacker to read or corrupt process memory and, if a crafted Brotli-compressed stream is processed, potentially execute arbitrary code. Microsoft’s Security Response Center (MSRC) rated the issue Critical (CVSS 8.1) and listed exploitation as “more likely,” though no active exploitation had been observed.
Background & Context
Brotli is an open-source compression library maintained by Google. Versions 1.0.3 through 1.2.0 were assigned CVE-2026-111497 by Google, which acted as the CVE Numbering Authority. The flaw resides in the library’s decompression routine and is inherited by .NET components that expose Brotli APIs, such as ASP.NET Core request decompression, HttpClient automatic response decompression, and the System.IO.Compression Brotli classes. The .NET Framework itself is not affected, and Brotli decompression is disabled by default; applications must explicitly opt-in to use these features.
Data & Statistics
- CVE-2026-111497 – Critical, CVSS 8.1.
- Affected .NET releases: 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3.
- Platforms impacted: Windows, macOS, and Linux.
- Related advisories: CVE-2026-70197 (CVSS 8.1) and CVE-2026-102870 (CVSS 8.8) were noted as still unaddressed on October 19, 2026; the October 13, 2026 patch did not resolve those issues.
Official Statements & Responses
Rahul Bhandari, senior program manager for Microsoft .NET, announced the vulnerability on October 25, 2026, describing it as a buffer-overflow that could let an attacker read or corrupt memory. He warned that “applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs,” and advised developers to update the runtime, rebuild self-contained applications, and redeploy containers with the patched images. MSRC reiterated that, while the flaw has been publicly disclosed and rated critical, there is no evidence of exploitation to date.
Conflicting Reports & Gaps
The NVD entry for CVE-2026-111497 lists a broader remediation scope, urging users of any Brotli library version 1.0.3-1.2.0 to upgrade to 1.0.10, 1.1.1, or 1.2.1. Microsoft’s patch addresses only the .NET runtime components and does not clear other products that bundle an affected Brotli copy. As of October 26, 2026, NVD had not yet published its own severity assessment, leaving a gap between vendor-specific guidance and the broader vulnerability database.
Developers are urged to apply the October 25 update promptly, verify that Brotli decompression is not unintentionally enabled, and monitor forthcoming guidance from MSRC and the NVD for any additional remediation steps.