1 of 1
Story summary
- Microsoft urges .NET developers to install out-of-band updates fixing CVE-2026-111497.
- The flaw is a buffer overflow in Google’s Brotli library that can let unauthenticated attackers read or corrupt memory.
- Google gives CVE-2026-111497 a 9.2 CVSS v4.0 score, while Microsoft lists it 8.1 under CVSS v3.1.
- OpenAI advises blocking untrusted Brotli data and disabling automatic Brotli decompression in HTTP clients.