Microsoft Releases Emergency .NET Updates to Fix Critical Memory Flaw

Microsoft has released out-of-band security updates for its .NET developer platform, including a fix for a critical buffer overflow vulnerability. The updates cover .NET versions 8, 9, 10 and 11 Release Candidate 3, and were published on October 25. Users are urged to apply them as soon as possible. Anyone on .NET 11 RC2 needs to move to RC3 to receive the fixes. The updates address two newly disclosed flaws, as well as two issues not fully fixed in October's Patch Tuesday.

The critical flaw, CVE-2026-111497, sits in the Brotli decompression algorithm used by .NET. It affects versions 8, 9, 10 and 11 on all operating systems and carries a CVSS score of 9.2. An unauthenticated attacker could read or corrupt process memory, which could lead to information disclosure, denial of service or elevation of privilege. Microsoft says applications may be affected if they handle Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. Users of Google Brotli versions 1.0.3 through 1.2.0 should also update any Brotli libraries or binaries.

The second new flaw, CVE-2026-114148, affects .NET versions 7 to 11 on Linux only. It could let an authorised attacker gain higher privileges locally by abusing unsafe ownership metadata in affected .NET tarballs. For .NET 10 and 11, only source-build tarballs are affected. For .NET 8 and 9, ASP.NET Core tarball distributions are also affected, even for users who do not build .NET from source. No CVSS score had been assigned at the time of writing.