Microsoft has released an out-of-band emergency security patch across supported versions of the .NET software ecosystem to resolve a critical flaw in the Brotli decompression algorithm. The update addresses a dangerous buffer overflow condition that could allow unauthenticated attackers to corrupt process memory or crash active applications.
Software developers and enterprise system administrators are urged to apply the updates immediately across development and production environments. The out-of-band deployment covers .NET 8, .NET 9, .NET 10, and preview builds of .NET 11.
Microsoft NET Emergency Security Update Brotli
The emergency release comes in response to CVE-2026-111497, an out-of-bounds memory write flaw rooted in the native underlying C library used for Brotli decompression. Beyond the headline Brotli flaw, Microsoft combined this release with patches for a Linux-specific elevated privilege issue (CVE-2026-114148) and refreshed fixes for two earlier October security advisories.
Emergency Out-of-Band .NET Security Patch
Out-of-band releases from Microsoft occur outside the traditional monthly Patch Tuesday cycle, signaling that a flaw requires prompt mitigation before standard servicing windows open. The primary issue stems from an upstream memory corruption bug in Google's Brotli decoder library, which is embedded directly into the native runtime components of .NET.
Alongside the Brotli patch, Microsoft re-issued updates for CVE-2026-70197, a memory corruption vulnerability involving SocketAsyncEventArgs, and CVE-2026-102870, which affects the Blazor WebAssembly debugging component. According to official advisory notes, previous update packages did not completely resolve those two vulnerabilities, necessitating comprehensive superseding builds in this out-of-band release.
Vulnerability Details and Affected Brotli Decompression
Tracked under CVE-2026-111497, the core vulnerability is an out-of-bounds write condition triggered when a vulnerable decoder encounters specially crafted Brotli-compressed data. If an application attempts to decompress a malicious payload, an unauthenticated attacker can force the application to read or overwrite process memory. This manipulation can result in data leaks, process crashes leading to denial of service, or potential elevation of privilege depending on process permissions.
Microsoft noted that legacy .NET Framework installations on Windows remain unaffected because they do not rely on the modern cross-platform Brotli implementation present in modern .NET Core and .NET 8+ runtimes. However, modern enterprise cloud services running on Linux or Windows servers with contemporary .NET SDKs must be updated. Developers looking for new platform tools can check how Microsoft unveils UI Reactor framework for native Windows 11 apps to explore modern app building standards.
Impacted Systems and Software Frameworks
The Brotli vulnerability affects any platform running .NET 8, .NET 9, or .NET 10. Microsoft has also published updated binaries for .NET 11 Release Candidate 3 to protect early adopters and preview testing servers. Because Brotli decompression APIs exist across desktop, server, and container environments, cross-platform workloads deployed on Linux distributions or Windows Server are equally vulnerable.
Additionally, Linux system administrators must account for CVE-2026-114148. This secondary vulnerability involves unsafe file ownership metadata embedded inside .NET source-build tarballs and ASP.NET Core distributions, which could allow a local Linux user to overwrite system files and elevate permissions.
Risks to ASP.NET Core and HTTP Client Applications
Not all .NET applications are exposed by default. Microsoft emphasized that ASP.NET Core web services and HttpClient routines do not automatically decompress Brotli data unless explicitly configured to do so. A server or client application becomes exposed if it performs any of the following operations:
- Enables ASP.NET Core request decompression with Brotli (
br) headers enabled. - Configures
HttpClientHandlerorSocketsHttpHandlerautomatic decompression settings to include Brotli streams. - Explicitly invokes the
System.IO.Compression.BrotliStreamorBrotliDecoderclasses on untrusted incoming data streams.
When services handle web requests or fetch remote API payloads while Brotli parsing is active, malicious network traffic can exploit the decoder without requiring user interaction. Maintainers managing enterprise communication channels should also note how Microsoft Teams to support third-party deepfake scanning as corporate cloud environments continue to enforce stricter automated security controls.
How to Apply the .NET Security Update
To fully secure systems, administrators must update both the developer SDK build tools and the target host runtimes. System operators utilizing cloud infrastructure can inspect network perimeter settings, but local application patching is mandatory to stop response-based attacks. Microsoft advises engineering teams to update their application build pipelines to target the newly released patch versions: .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, or .NET 11.0 RC3.
In cases where updates cannot be deployed immediately, organizations should temporarily disable Brotli request and response handling within their middleware configurations, falling back to standard Gzip or Deflate algorithms until patched runtimes are deployed.
Installer Downloads and Deployment Recommendations
Updated runtimes and SDKs are now available through official Microsoft download portals, Visual Studio updates, and package management repositories such as Microsoft's Linux package feeds. For framework-dependent applications, installing the updated runtime on host machines or updating base container images will resolve the flaw without requiring complete application recompilation. Self-contained applications, however, must be rebuilt using the updated .NET SDK versions so that the patched native Brotli binary is bundled into the application directory.
Organizations managing desktop fleets or standalone installations can monitor system performance post-patch. As part of overall system health maintenance, system engineers frequently review internal mechanisms, similar to how Microsoft clarifies why clearing Windows 11 Prefetch harms PC performance during routine troubleshooting procedures.
With memory corruption risks present in shared compression libraries across modern development stacks, IT managers should prioritize rolling out these out-of-band updates promptly to secure internal infrastructure against potential exploitation.
