On October 25, 2026, Microsoft released out-of-band .NET security updates, including a fix for CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The flaw can corrupt memory when an application decompresses attacker-controlled data. Installing a fixed runtime is necessary, but self-contained deployments and containers also need to be rebuilt.
The flaw affects Brotli data processing
Microsoft’s bulletin describes a vulnerability in the Brotli decoder used by .NET. Malicious input can cause memory to be read or corrupted, creating a risk of information disclosure, denial of service or privilege escalation depending on the application.
A vulnerable version does not automatically mean an application is reachable through this path. The application must decompress attacker-controlled data, for example through ASP.NET Core request decompression configured for Brotli, enabled automatic decompression in HttpClient or direct calls to Brotli APIs.
Which versions to install
Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14, along with .NET 11 Release Candidate 3. The updates also include CVE-2026-114148, which concerns file ownership in some Linux tarballs. Use Microsoft’s tables to check the SDKs, platforms and packages you actually run.
Microsoft also reissued advisories for two flaws whose October 13 fixes were incomplete: CVE-2026-70197 and CVE-2026-102870. Organizations that installed the earlier update should check the current bulletin and the versions now deployed.
Check your actual exposure
Inventory installed runtimes and SDKs, then review how each application handles Brotli compression. Do not disable a feature without understanding its effect on the application. If software does not process untrusted Brotli data through the described paths, the presence of .NET alone does not prove it is exposed to this attack.
As a temporary measure before deployment, Microsoft advises against passing untrusted Brotli data to the affected decompression APIs. Have application owners review any configuration change.
Update each deployment model
For a framework-dependent application, install the fixed runtime for its target version and restart the application. A self-contained application carries its own runtime, so rebuild and republish it with the fixed packages. Installing a newer shared runtime on the host does not replace the bundled one.
For containers, rebuild images from updated base images and redeploy workloads. Then confirm the version in the live environment. Processes already running continue to use libraries loaded before the restart.
The connection with Soclyde
Development and operations teams can keep access to repositories, container registries and environments in an encrypted vault, using distinct secrets. Soclyde helps organise those credentials; it does not patch Brotli or .NET applications.
See Soclyde features for organising credentials shared within a small team.
What to remember
Install the fixed .NET versions, confirm which decompression paths are used, and rebuild self-contained applications and containers. Exposure depends on how each application processes untrusted Brotli input. To organise operational credentials, read our password security guide.
