Microsoft Patches Critical Brotli Decoder Vulnerability in .NET and Visual Studio
Microsoft has released security updates for .NET and Visual Studio to address a high-severity out-of-bounds write vulnerability in the Brotli decoder.
Microsoft patched CVE-2026-111497 on 25 October. This out-of-bounds write in the Brotli decoder carries an 8.1 severity rating.
Fixes land in .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 RC3. Visual Studio 2019, 2022, and 2026 receive updates alongside PowerShell 7.4 through 7.6. No exploitation is reported in the wild. A public proof-of-concept only targets a deliberately weakened build rather than a standard release.
Exposure happens whenever attacker-controlled Brotli data reaches the decoder. This covers request bodies sent to servers, responses from untrusted servers, and opened compressed files.
Updating shared machine-wide .NET installations is straightforward. However, self-contained deployments and container images bundle their own runtimes. You must rebuild and redeploy those manually.
Tracing Brotli decoding paths through dependencies remains difficult. You should apply updates to developer machines and build agents, then rebuild any self-contained or containerized apps shipping their own runtime.