Microsoft Issues Emergency .NET Patches for Critical Brotli Decoder Flaw

Key points

• Microsoft released emergency out-of-band updates for .NET 8, 9, 10, and 11 Release Candidate 3 on October 25, 2026.
• The critical vulnerability CVE-2026-111497 affects the Brotli decompression algorithm, enabling remote code execution or privilege escalation.
• The flaw impacts applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.
• Microsoft also fixed a local privilege escalation flaw (CVE-2026-114148) in Linux tarballs and re-issued fixes for two other vulnerabilities from the October Patch Tuesday.
• No active exploitation in the wild has been reported, but proof-of-concept exploits are publicly available on GitHub.
• Users unable to patch immediately should block Brotli-compressed requests via proxies or firewalls or disable Brotli decoding.

Background

This incident follows a broader wave of security patches for the same Brotli decoder flaw across multiple platforms. In late October 2026, Node.js, PHP, and other ecosystems released emergency updates to address similar critical remote code execution vulnerabilities. The current .NET update is part of a coordinated response to CVE-2026-111497, which has been confirmed in various software stacks including FFmpeg and ClickHouse.

How outlets are covering it

BleepingComputer emphasizes the critical severity and potential for remote code execution, noting that while no active exploitation has occurred, proof-of-concept exploits exist. Infosecurity Magazine highlights that the update addresses two new vulnerabilities and re-issues fixes for two others from the October Patch Tuesday, providing detailed remediation steps for different deployment types. Both sources agree on the urgency of applying updates but differ in emphasis: BleepingComputer focuses on the attack vector and mitigation via blocking, while Infosecurity Magazine details the specific affected configurations and additional vulnerabilities fixed in the same release.

Why it matters

The vulnerability affects a widely used compression algorithm in a core developer platform, posing a significant risk to web applications and services that process Brotli-compressed data. The critical CVSS score and potential for remote code execution necessitate immediate action to prevent compromise, especially given the availability of proof-of-concept exploits.

What to watch

Organizations should immediately apply the out-of-band updates for their respective .NET versions. Those unable to patch should implement temporary mitigations such as blocking Brotli-compressed requests or disabling Brotli decoding. Continued monitoring for signs of exploitation is recommended, as the vulnerability remains a high-priority threat across multiple software ecosystems.