Microsoft Issues Critical Security Patches for .NET 8, 9, 10, and 11 RC3
Microsoft has released out-of-band updates to address a critical Brotli buffer overflow vulnerability and a Linux ownership flaw affecting multiple .NET versions.
Microsoft released out-of-band updates for .NET versions 8, 9, 10, and .NET 11 Release Candidate 3. Install them quickly.
The release patches CVE-2026-111497, a buffer overflow in Brotli decompression affecting all platforms. Unauthenticated attackers can read or corrupt process memory. This leads to information disclosure, denial of service, or elevation of privilege. Exposure occurs when apps process Brotli data using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs. Request and response decompression are off by default. .NET Framework is unaffected.
CVE-2026-114148 is a Linux tarball ownership flaw. Unsafe ownership metadata lets local attackers modify files and gain elevated privileges. On .NET 10 and 11, source-build tarballs are affected. On .NET 8 and 9, ASP.NET Core tarballs are also affected.
The patches also finish fixes for two previous issues from October 13, 2026: CVE-2026-70197, a SocketAsyncEventArgs memory corruption bug, and CVE-2026-102870, a Blazor WebAssembly debugger issue.
Patched versions are 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3. .NET 11 RC2 users must update to RC3.
Update steps vary. Framework-dependent apps need the updated runtime and a restart. Self-contained apps require a rebuild and republish. Containers need a rebuild and redeploy. Source-build consumers need updated source-build artifacts. ASP.NET Core tarball users on .NET 8 and 9 must use the refreshed runtime tarball.
Run dotnet --list-runtimes to check framework-dependent runtimes.