.NET 8.0.33, 9.0.22 and 10.0.14 Ship Out-of-Band Fixes for a Brotli Buffer Overflow, CVE-2026-111497, Alongside .NET 11 Release Candidate 3
Microsoft's out-of-band .NET release fixes CVE-2026-111497 in Brotli decompression and a Linux tarball ownership flaw, and re-releases two advisories the October 13 release did not fully address.
Overview
Microsoft has released out-of-band (OOB) security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, according to the .NET Blog post of October 25, 2026. The post says: “We recommend updating as soon as possible.” The fixes for the supported lines ship as .NET 8.0.33, 9.0.22 and 10.0.14; .NET 11 is covered by its third release candidate, a pre-release build.
What We Know
Two new CVEs
The .NET Blog lists two new vulnerabilities:
- CVE-2026-111497, described as a buffer overflow in .NET’s use of the Brotli decompression algorithm that “may allow an unauthenticated attacker to read or corrupt process memory”. The post says this could lead to information disclosure, denial of service or elevation of privilege, and lists the affected platforms as All Platforms.
- CVE-2026-114148, described as unsafe ownership metadata in affected .NET tarballs that “could allow a local attacker to modify files and gain elevated privileges”. It affects Linux. For .NET 10 and .NET 11 it affects source-build tarballs only; for .NET 8 and .NET 9 it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, “including users who do not build .NET from source”.
The same post says applications may be affected by the Brotli flaw if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. It adds that request decompression and automatic response decompression are not enabled by default, and that .NET Framework is not affected.
Two advisories re-released
The .NET Blog also says it is re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10 and 11, and for CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11, “because the October 13, 2026 release did not fully address these issues”. The post says the new updates provide those fixes. The earlier release was the October servicing update, which the .NET Blog described as refreshed “as of October 13, 2026” and which shipped .NET 10.0.13, 9.0.21 and 8.0.32.
Versions and deployment
Per the OOB post, the updates are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3. It states that ”.NET 11 RC2 users should update to RC3 to receive these fixes.” The .NET 11 RC2 announcement described that earlier pre-release as coming with a go-live support license.
The OOB post gives separate instructions by deployment type. Framework-dependent applications should install the updated runtime and restart. Self-contained applications should be rebuilt and republished, because installing a newer runtime on the host does not update the runtime bundled with the application. Containers should be rebuilt and redeployed on updated .NET container images.
The same CVE identifier at Node.js
The Brotli identifier also appears in the Node.js project’s October security releases, which The Machine Herald previously reported. The Node.js advisory lists “Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)” with a High rating, and says the flaw is in the Brotli decoder bundled with Node.js. Both projects therefore cite the same CVE number for Brotli decoding. The .NET post does not describe the root cause, name the upstream component, or say how the .NET and Node.js fixes relate.
What We Don’t Know
- The .NET post does not give a severity rating or CVSS score for either new CVE.
- It does not say whether either has been exploited in the wild.
- It does not say who reported the Brotli flaw.
- It does not explain why the October 13 release did not fully address the two re-released advisories.