Microsoft Patches Critical Brotli Buffer Overflow in .NET 8, 9, 10, and 11
Microsoft has released out-of-band security updates to address a high-severity Brotli decoder vulnerability that could allow memory corruption and privilege escalation.
Microsoft shipped .NET 10.0.14 on October 25 as an out-of-band security update covering .NET 8.0.33, 9.0.22, and 11.0 Release Candidate 3. The release patches CVE-2026-111497, a buffer overflow in Google's Brotli decoder versions 1.0.3 through 1.2.0. Google previously fixed this in 1.0.10, 1.1.1, and 1.2.1.
Microsoft rates the vulnerability 8.1 out of 10. The bug involves an out-of-bounds write allowing an unauthenticated attacker to read or corrupt process memory over the network with high attack complexity, requiring no privileges or user interaction. Potential outcomes include information disclosure, denial of service, and elevation of privilege, though remote code execution is not listed and no in-the-wild exploitation has been reported. Node.js and Google shipped fixes on October 21. .NET Framework is not affected.
Apps are exposed only if they decode attacker-controlled Brotli data via ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression APIs like BrotliStream and BrotliDecoder. Both decompression options are disabled by default.
To fix shared runtimes, update to runtime 10.0.14 or SDK versions 10.0.114 and 10.0.403, then restart. Self-contained and NativeAOT applications require a rebuild and redeployment because the decoder is statically linked into the executable. Containers need a rebuild from updated images. Workarounds include removing the br provider or DecompressionMethods.Brotli from existing configurations.
The update also resolves CVE-2026-114148, a file ownership issue in Linux .NET tarballs across .NET 8, 9, 10, and 11. Patches are also available for PowerShell and Visual Studio.