Vulnerabilities
Microsoft issues emergency .NET patches for critical buffer overflow flaw
Microsoft has released urgent security updates for .NET to fix a critical buffer overflow vulnerability and other flaws. Users are urged to update immediately to protect against potential attacks.
Ross Grant3 min read
The short version
Microsoft has released urgent security updates for its .NET software, which is used to build many apps and services. A serious flaw in the Brotli decompression feature could let attackers read or change sensitive data. The company urges all users to update their software right away. These fixes also cover other vulnerabilities found earlier this month.
By the numbers
- 9.2CVSS score for the critical buffer overflow flaw (CVE-2026-111497)Infosecurity Magazine
- 4.NET versions affected (8, 9, 10, 11)Infosecurity Magazine
What happened?
Microsoft released emergency security updates for .NET on 25 October to fix a critical buffer overflow vulnerability and other flaws. The main flaw affects the Brotli decompression algorithm and could let attackers read or corrupt memory. The updates also address other vulnerabilities not fully fixed in October's Patch Tuesday. Only Infosecurity Magazine has reported this so far.
Who is affected
The emergency updates apply to .NET versions 8, 9, 10, and 11 Release Candidate 3, across Windows, Linux, and macOS. The vulnerabilities affect anyone running applications or services built on these .NET versions. Developers using Brotli compression in their apps, especially through ASP.NET Core or the System.IO.Compression Brotli APIs, are at particular risk. Users of Google Brotli libraries (versions 1.0.3 to 1.2.0) are also advised to update their Brotli components.
How the flaw works
The most severe vulnerability, CVE-2026-111497, is a buffer overflow in the Brotli decompression algorithm. A buffer overflow happens when a program writes more data to a memory area than it can hold, which can let attackers overwrite or read sensitive information. In this case, an unauthenticated attacker could exploit the flaw to read or corrupt process memory. This could lead to information disclosure, denial of service (making the app crash or stop responding), or even elevation of privilege (gaining higher access than intended). The flaw has a critical CVSS score of 9.2, which means it is easy to exploit and could have a major impact if left unpatched.
Another vulnerability, CVE-2026-114148, affects .NET versions 7 to 11 on Linux systems. It allows an authorised attacker to elevate privileges locally by exploiting unsafe ownership metadata in .NET tarballs (compressed archive files used for distribution). For .NET 8 and 9, this also affects ASP.NET Core distributions from tarballs, even for users who do not build .NET from source. This vulnerability does not yet have a public CVSS score.
The response
Microsoft released out-of-band (OOB) updates on 25 October to address these vulnerabilities. The company advises all .NET users to install the updated runtime for their version and restart their applications. Developers should rebuild and redeploy self-contained apps and containers with the new runtime. For those using source-build tarballs or ASP.NET Core tarballs, Microsoft recommends obtaining the refreshed packages and rebuilding to ensure the fixes are included.
The updates also re-issue fixes for two earlier vulnerabilities from October Patch Tuesday: CVE-2026-70197 (memory corruption in .NET 8-11) and CVE-2026-102870 (code injection in .NET 10 and 11).
Is there a fix?
Yes. Microsoft has published single updates for each affected .NET version. Users of .NET 11 RC2 must update to RC3 to get the latest fixes. Google Brotli users should update their libraries or binaries to the latest version to avoid exposure to the buffer overflow flaw.
What you should do
- Install the latest .NET runtime updates for your application version and restart your apps.
- Rebuild and redeploy self-contained applications and containers using the updated runtime.
- If you use source-build or ASP.NET Core tarballs, update to the latest packages and rebuild your software.
- Update any Google Brotli libraries or binaries to the newest version.
These steps will help protect your systems from the critical vulnerabilities described above.
Why it matters
The flaws could let attackers steal data, crash applications, or gain higher access on systems running .NET. Many businesses and cloud services rely on .NET, so unpatched systems could be at risk until updates are applied.
Key points
- Critical buffer overflow flaw in .NET Brotli decompression fixed in emergency patch
- Affects .NET versions 8, 9, 10, and 11 across all major operating systems
- Attackers could read or corrupt memory, leading to data leaks or privilege escalation
- Microsoft urges immediate updates and provides detailed patching steps
- Other vulnerabilities from October Patch Tuesday also re-patched
Sources
Infosecurity Magazine
Reference
- Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw (opens in a new tab)
infosecurity-magazine.com
- Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw (opens in a new tab)
