Microsoft Releases Out-of-Band Security Updates for Brotli and .NET tarballs Vulnerability

Microsoft has released out-of-band security updates for .NET to fix a Brotli buffer overflow and unsafe ownership settings in Linux distribution archives.

Published on October 25, 2026, the release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft urges users to update as soon as possible.

The official Microsoft announcement also confirms that these updates complete fixes for two vulnerabilities that were not fully resolved in the October 13 release. The patches therefore matter even for teams that already installed this month’s earlier .NET updates.

Tracked as CVE-2026-111497, the first vulnerability affects .NET’s use of Brotli decompression across all platforms. A buffer overflow could allow an unauthenticated attacker to read or corrupt process memory. Possible outcomes include data exposure, application crashes, or elevated privileges.

Applications may be exposed when they handle Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.

Microsoft Issues Emergency Brotli and .NET Updates

Microsoft notes that request decompression and automatic response decompression are not enabled by default. The older .NET Framework is not affected.

This makes application configuration important when assessing exposure. Teams should identify services that actually process Brotli content rather than assume every .NET application has the same risk.

Cybersecuritynews previously covered a separate .NET denial-of-service vulnerability, highlighting another case where application availability was at risk.

The second vulnerability, CVE-2026-114148, concerns unsafe ownership metadata in affected Linux .NET tarballs. These archives contain ownership information for packaged files.

Microsoft says the flaw could let a local attacker modify files and gain higher privileges. Unlike the Brotli issue, this vulnerability affects Linux specifically.

For .NET 10 and .NET 11, the problem affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core installations obtained through ASP.NET Core tarballs. Users in that second group need refreshed archives even when they do not build .NET from source.

The release also completes fixes for CVE-2026-70197, involving SocketAsyncEventArgs memory corruption, and CVE-2026-102870, involving the Blazor WebAssembly debugger. These affect .NET 8 through 11 and .NET 10 through 11, respectively.

The patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3. Users running .NET 11 RC2 should move to RC3. The release follows earlier emergency servicing, including Microsoft’s .NET 10.0.7 security update.

Framework-dependent applications require the updated runtime and an application restart. Self-contained applications must be rebuilt and republished because installing a newer host runtime does not replace their bundled runtime. Container users must rebuild and redeploy using updated .NET images.

Source-build users should obtain refreshed artifacts and rebuild packages. Administrators can check installed runtimes with dotnet –list-runtimes, but must verify self-contained applications and containers separately. Microsoft’s .NET deployment documentation explains these deployment differences and helps teams choose the correct update path for each application.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Releases Out-of-Band Security Updates for Brotli and .NET tarballs Vulnerability appeared first on Cyber Security News.