.NET out-of-band update fixes Brotli overflow and tarball flaw

.NET out-of-band update fixes Brotli overflow and tarball flaw

25 October 2026: Microsoft has released out-of-band security updates for .NET 8, 9 and 10 and a third release candidate of .NET 11 to fix CVE-2026-111497, a buffer overflow in .NET's use of Brotli decompression that may let an unauthenticated attacker read or corrupt process memory. The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14, and Microsoft recommends updating as soon as possible.

Not yet independently verified. The descriptions are Microsoft's, from its release post; we did not read the per-CVE advisories, and the post gives no CVSS scores or exploitation status. We will update this when it can be confirmed, and remove this note.

The same release fixes CVE-2026-114148 on Linux and re-issues two fixes from the 13 October Patch Tuesday that, in Microsoft's words, "did not fully address" the issues.

Fixed versions

Line	Fixed release
.NET 8	8.0.33
.NET 9	9.0.22
.NET 10	10.0.14
.NET 11	Release Candidate 3 (RC2 users should move to RC3)

.NET Framework is not affected.

Which applications are exposed to the Brotli flaw

The overflow is reachable when an application processes Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs, on every platform. Microsoft says it could lead to information disclosure, denial of service or elevation of privilege. Request decompression and automatic response decompression are both off by default, so the services most at risk are those that turned one on, or that call the Brotli APIs directly on data from outside.

It is the .NET side of the Brotli decoder flaw we covered when the Brotli project shipped its own fix, and Node.js patched it in its own releases.

The Linux tarball flaw and the two re-released fixes

CVE-2026-114148 is unsafe ownership metadata in affected Linux tarballs, which could let a local attacker modify files and gain elevated privileges. On .NET 10 and 11 it touches source-build tarballs only; on .NET 8 and 9 it also affects ASP.NET Core tarball distributions, including for teams that never build .NET from source.

The re-released advisories are CVE-2026-70197, memory corruption in SocketAsyncEventArgs on .NET 8 through 11, and CVE-2026-102870, in the Blazor WebAssembly debugger on .NET 10 and 11. Anyone who patched on 13 October and stopped there is still exposed to both.

Getting the fix into every deployment

Installing the runtime on a host covers only framework-dependent apps, which then need a restart. Self-contained applications carry their own runtime and must be rebuilt and republished, containers must be rebuilt on the updated images, and ASP.NET Core tarball users on .NET 8 and 9 need the refreshed tarball. Microsoft suggests dotnet --list-runtimes to see what a machine has, and warns that self-contained and container deployments have to be checked separately.

Related on TrustList:

• musl libc fixes regcomp overflows that can corrupt the heap
• Azure Functions ends .NET 8, .NET 9 and PowerShell 7.4 support on 10 November

Sources

• Microsoft .NET Blog: .NET October 2026 out-of-band security updates, 25 October 2026