Microsoft has issued urgent out-of-band security updates for its .NET framework, addressing critical vulnerabilities related to Brotli buffer overflow and unsafe ownership settings in Linux distribution archives. These vulnerabilities could potentially expose data or elevate privileges if left unpatched.
Critical Security Patches Released
On October 25, 2026, Microsoft rolled out security patches for .NET 8 through .NET 11 Release Candidate 3. The company strongly advises all users to implement these updates without delay. The recent patches address two significant security flaws that were not fully resolved in the earlier updates released on October 13, emphasizing the importance of this current update.
Understanding Brotli and .NET Vulnerabilities
The first vulnerability, identified as CVE-2026-111497, affects Brotli decompression across all platforms. A buffer overflow within this process could allow attackers unauthorized access to read or corrupt memory, potentially leading to data breaches, application crashes, or elevation of privileges. This risk is particularly pertinent when applications utilize Brotli compression through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.
Microsoft points out that these decompression features are not enabled by default, and the older .NET Framework remains unaffected by this issue. Therefore, organizations need to carefully assess which applications process Brotli-compressed data to determine their exposure level.
Linux-Specific Vulnerability and Broader Implications
The second flaw, CVE-2026-114148, involves unsafe ownership metadata in Linux .NET tarballs. This vulnerability allows local attackers to alter files, gaining higher privileges. The issue mostly impacts source-build tarballs for .NET 10 and .NET 11, while also affecting ASP.NET Core installations via ASP.NET Core tarballs for .NET 8 and .NET 9.
Additionally, the update addresses CVE-2026-70197, concerning SocketAsyncEventArgs memory corruption, and CVE-2026-102870, related to the Blazor WebAssembly debugger. Both of these affect various .NET versions, underscoring the comprehensive scope of this security release.
Guidance for .NET Users
To ensure security, users must update to the latest patched versions: .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 RC3. It is essential for users of .NET 11 RC2 to upgrade to RC3 immediately. Framework-dependent applications require both an updated runtime and an application restart, whereas self-contained applications need to be rebuilt and republished. Container users must also rebuild and redeploy with the updated .NET images. For precise update paths and deployment differences, administrators should refer to Microsoft’s .NET deployment documentation.
Given the critical nature of these updates, Microsoft emphasizes the urgency of applying these patches to safeguard systems against potential exploits.
