Full Breakdown
Microsoft Issues Emergency .NET Patch for Critical Brotli Vulnerability
By Drooid · · How we work
Core Event: Out-of-Band .NET Update Patches CVE-2026-111497
Microsoft released an out-of-band update for .NET 8-11 (including the release candidate) on October 25. The patch fixes a buffer-overflow flaw in Google’s Brotli compression library (CVE-2026-111497), rated 8.1 / 10 (CVSS v3.1). The vulnerability could let an unauthenticated attacker read or corrupt process memory, leading to disclosure, denial-of-service, or privilege escalation. Microsoft classified it “critical” for .NET and Visual Studio and “important” for PowerShell, noting exploitation is “more likely.”
Background & Context
Brotli’s decoder was patched in February 2024, but the security impact was not recognized until it surfaced in Node.js on October 21. OpenAI’s Codex Security team (Khai Tran and Sylvie Mayer) identified the root cause and reported it to Google, which assigned CVE-2026-111497 and rated the flaw 9.2 / 10 (CVSS v4.0). Affected Brotli versions are 1.0.3-1.2.0; fixed releases are 1.0.10, 1.1.1 and 1.2.1. After the Node.js disclosure, patches were issued for Python, Bun, Envoy, Istio, FFmpeg, Apache Arrow and other projects that bundle Brotli.
Data & Statistics
- Severity ratings: Microsoft 8.1 (v3.1); Google 9.2 (v4.0); Red Hat 8.1 (v3.1).
- Cloud exposure: 91 % of cloud environments contain Brotli-enabled components; 82 % expose Node.js instances publicly (Merav Bar, Wiz).
- Affected ecosystems: .NET, Visual Studio, PowerShell, Node.js, Python, Bun, Envoy, Istio, FFmpeg, Apache Arrow, DuckDB, 7-Zip-zstd, p7zip, EDK II (still unpatched).
Official Statements & Responses
- OpenAI: The root cause was fixed in the Brotli source in February; the security implication was identified later.
- Wiz: Threat researcher Merav Bar warned that cloud environments are “particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.”
- CISA: Its October 23 assessment recorded no exploitation of the flaw and noted its absence from the Known Exploited Vulnerabilities catalog.
Conflicting Reports & Gaps
OpenAI and independent researchers have demonstrated proof-of-concept exploits against certain builds, indicating technical exploitability. CISA, however, reported no observed exploitation in the wild and excluded the flaw from its catalog of actively exploited vulnerabilities. No public incidents have been documented to date.
Verbatim Quotes
- “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.” — Merav Bar, Wiz
- “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” — OpenAI
What’s Next: Mitigation Guidance
OpenAI’s “Patch the Planet” advisory recommends blocking untrusted Brotli-compressed data, rebuilding affected deployments, and restarting services to load the patched library. For environments that cannot update immediately, disable automatic Brotli decompression in HTTP clients (e.g., avoid `CURLOPT_ENCODING` in PHP’s cURL or set `decode_content` to false in Guzzle). Continue monitoring vendor releases for remaining unpatched components such as DuckDB and EDK II.