Full Breakdown
Microsoft Issues Emergency Out-of-Band Patch for Critical Brotli Buffer-Overflow Flaw
By Drooid · · How we work
Core Event
On Sunday, Microsoft released an out-of-band security update for .NET, Visual Studio and PowerShell to address CVE-2026-111497, a buffer-overflow vulnerability in Google’s Brotli compression library. The flaw, discovered on October 22, can allow an unauthenticated attacker to read or corrupt process memory, potentially leading to information disclosure, denial-of-service or privilege escalation. Microsoft rated the issue critical for .NET and Visual Studio and important for PowerShell. The update also covers Node.js users, whose environments bundle Brotli.
Background & Context
Brotli, a lossless compression algorithm created by Google in 2015, is widely used for web content, code and image delivery. The vulnerability resides in Brotli’s C decoder and affects versions 1.0.3 through 1.2.0; it was fixed in Brotli source code in February, though the fix was not publicly known until the recent disclosures. Google assigned the CVE a severity score of 9.2 / 10. Node.js and Google issued patched releases on October 21.
Official Statements & Responses
Microsoft’s Security Response Center confirmed the flaw is publicly disclosed and not yet exploited, but judged exploitation “more likely.” Rahul Bhandari, senior program manager for Microsoft .NET, warned that applications processing Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs could be affected. He advised developers to update immediately, noting that Brotli decompression is not enabled by default in .NET and that the .NET Framework is unaffected. OpenAI’s Codex Security team reported the issue to Microsoft, and OpenAI later clarified that the root-cause fix existed in February but was unknown at the time of discovery.
Data & Statistics
- Wiz, a cloud-security firm, estimates 91 % of cloud environments have resources vulnerable to the flaw, with 82 % exposing Node.js instances publicly.
- The vulnerability impacts Brotli 1.0.3-1.2.0; versions 1.0.10, 1.1.1 and 1.2.1 contain the fix.
- Multiple ecosystems—including Bun, Envoy, Istio, Python’s Brotli packages, FFmpeg, ClickHouse and Apache Arrow—have released patches, while a public tracker still lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as unpatched.
Verbatim Quotes
- “Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System. IO.Compression Brotli APIs,” — Rahul Bhandari, a senior program manager for Microsoft
- “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” — Codex Security. OpenAI