Microsoft Emergency Patch Fixes Critical .NET Buffer Overflow Flaw

What happened

Microsoft shipped out-of-band updates on October 25 for .NET 8, 9, 10 and 11 RC3. They fix CVE-2026-111497, a critical flaw (CVSS 9.2) in Brotli decompression that lets an unauthenticated attacker read or corrupt process memory, plus CVE-2026-114148, local privilege escalation in .NET tarballs on Linux. They also re-issue fixes for two October 13 Patch Tuesday flaws that were not fully fixed.

Why it matters

Apps that process Brotli-compressed data through ASP.NET Core, HttpClient or System.IO.Compression face information disclosure, denial of service or privilege elevation. Any company running .NET apps or cloud services is exposed, and Linux systems using .NET tarballs carry added local privilege escalation risk.

What to do

Install the updated runtime for every .NET version in use and restart apps; rebuild and republish self-contained apps and containers with updated images. Move .NET 11 RC2 to RC3. For Blazor, also update the Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer NuGet packages, as a runtime update alone is not enough.

For the technical team

CVE

CVE-2026-102870, CVE-2026-70197

Affected

Microsoft .NET · .NET 8, 9, 10 and 11 across all operating systems (CVE-2026-111497). CVE-2026-114148: .NET 7-11, Linux only; on .NET 10 and 11, source-build tarballs only; on .NET 8 and 9, also ASP.NET Core distributions obtained through tarballs, including users who do not build .NET from source. CVE-2026-70197: .NET 8-11. CVE-2026-102870: .NET 10 and 11. Google Brotli 1.0.3 through 1.2.0 also needs updating.

Exploitation

No exploitation reported in the sources; disclosure stage with a fix available. CVE-2026-114148 has no CVSS score yet, only reserved by a CNA.

Fix

Out-of-band updates released October 25, one per affected .NET version; .NET 11 RC2 users should update to RC3. Install the updated runtime and restart framework-dependent apps; rebuild and republish self-contained apps; rebuild containers with updated .NET images; obtain updated source-build artifacts and rebuild packages to incorporate the tarball ownership fix; for ASP.NET Core tarball users on .NET 8 and 9, update via the refreshed ASP.NET Core Runtime tarball. Blazor: update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including 10.0.14 for .NET 10 projects. Google Brotli: update libraries and binaries to the latest version.

Vector

CVE-2026-111497: out-of-bounds write in the Brotli decompression algorithm used by .NET, exploitable by an unauthenticated attacker when the app processes Brotli data via ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. CVE-2026-114148: unsafe ownership metadata in .NET tarballs on Linux, exploitable by an authorized attacker to elevate privileges locally.

More details

The update re-issues fixes for CVE-2026-70197 (SocketAsyncEventArgs memory corruption.NET 8-11) and CVE-2026-102870, not fully addressed in the October 13 Patch Tuesday. Infosecurity Magazine describes CVE-2026-102870 as a code injection flaw in .NET 10 and 11; DarkWebInformer describes it as RCE (CVSS 8.8) in the Blazor WebAssembly debugger requiring user interaction: attacker-controlled data from a debugged application escapes a generated C# string when the developer evaluates an expression. Microsoft warns that updating the shared .NET runtime alone does not fix the Blazor flaw when affected NuGet packages are referenced directly. Brotli was designed by two Google engineers in 2015.

Timeline

1. 10/26/2026 01:58 PM

   Microsoft ships out-of-band updates for .NET 8, 9, 10 and 11 after incomplete October 13 fixes.

2. 10/26/2026 01:44 PM

   Microsoft releases an emergency fix for a critical .NET buffer overflow.

Sources 2 sources

• Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw Infosecurity Magazine
• @DarkWebInformer @DarkWebInformer

See all news