Microsoft has issued urgent out-of-band patches for .NET covering critical vulnerabilities in Brotli decompression and unsafe ownership metadata within Linux distribution archives. These fixes apply to .NET 8, 9, 10, and 11 Release Candidate 3, and include fixes that weren’t fully addressed in the prior .NET updates from October 13. Users are urged to update immediately.
What’s at Risk
The first vulnerability, tracked as CVE-2026-111497, involves a buffer overflow in how .NET handles Brotli-compressed data. If exploited by an unauthenticated attacker, it could permit reading or corrupting process memory, causing data leaks, application crashes, or privilege escalation. This flaw affects all platforms when using Brotli decompression, including through ASP.NET Core request decompression, HTTP response decompression via HttpClient, and System.IO.Compression Brotli APIs.
The second issue, CVE-2026-114148, stems from unsafe ownership settings stored in Linux .NET tarballs. Ownership metadata in these archives could allow a local attacker to overwrite files or elevate permissions. On .NET 10 and 11, the flaw is confined to source-build tarballs; on .NET 8 and 9, it also impacts ASP.NET Core installations acquired via tarballs—even if .NET isn’t being built from source.
Updates & Deployment Guidance
The patches also round out earlier fixes for additional vulnerabilities: CVE-2026-70197, a memory corruption issue in SocketAsyncEventArgs, and CVE-2026-102870, a bug in the Blazor WebAssembly debugger. All are addressed in .NET 8 through 11 (with varying coverage).
The specific patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 RC3. Users still running .NET 11 RC2 should upgrade to RC3. In framework-dependent apps, updating the runtime and restarting the app suffices. Self-contained apps require rebuilding and redistributing, because they bundle the runtime. Containerized deployments likewise need rebuilding with refreshed .NET images. For Linux/source-build users, updated artifacts must be pulled and used. Administrators can verify runtimes using “dotnet –list-runtimes” but must separately check self-contained and container apps to ensure they’re not running vulnerable builds.
It’s important to note that Brotli request and response decompression are not enabled by default. Legacy .NET Framework versions are not impacted. Therefore, risk depends heavily on app configuration; organizations should identify which services process Brotli content rather than assume universal exposure.
Even teams that applied the October 13 .NET security updates are impacted, because these out-of-band fixes complete patches that were only partially deployed earlier. Assessment and timely deployment are necessary to close these gaps.
What to Do Now: Audit .NET deployments for Brotli usage, check tarball sources for unsafe ownership metadata, update runtimes, rebuild self-contained and container apps, and refresh artifacts in source builds.
How This Fits into the Bigger Picture: Brotli compression is widely used for web performance in most modern web servers and clients. Tarballs are standard for distributing software on Linux. Vulnerabilities in these foundational systems can cascade, enabling attackers to breach low-risk systems more easily. Microsoft’s prompt response shows how rapidly security flaws in dependencies must be managed in modern cloud and cross-platform stacks.
In short: these fixes are not optional. Whether you’re managing web APIs, desktop-apps, containers, or server infrastructure, the risk is real. Watch for exploits targeting Brotli or metadata in deployments. Moving forward, developers should expect configuration hardening and tighter shipping practices around compression and archive security across .NET toolchains.
Why It Matters: These disclosures underscore how even unlikely vectors—compression libraries and archive metadata—can become high-risk attack paths, especially in ubiquitous platforms like .NET. For security teams, the challenge is both technical and operational: knowing what parts of your stack are exposed, keeping up with patch schedules, and ensuring rebuilds—not just installs. Going forward, transparency on what was patched, and how consumers know they’re fully protected, will remain key metrics of trust for cloud and development platforms.
