Microsoft Issues Emergency .NET Patches for Critical Brotli Decoder Flaw
Microsoft released out-of-band security updates for .NET versions 8 through 11 to address a critical out-of-bounds write vulnerability in the Brotli decoder, known as Broccoli2Shell. The flaw, tracked as CVE-2026-111497, carries a CVSS score of 9.2 and allows unauthenticated attackers to trigger crashes, memory leaks, or remote code execution. Although no active exploitation has been reported, proof-of-concept exploits are available, and Microsoft urges immediate patching for systems using Brotli decompression features.