Microsoft patches CVE-2026-111497 in .NET

Microsoft released an out-of-band security update for .NET that fixes CVE-2026-111497, a buffer overflow vulnerability in the Brotli decompression algorithm. According to the company, an unauthenticated attacker could read or corrupt process memory, with possible information disclosure, denial of service, or privilege escalation.

What versions did Microsoft patch?

Microsoft listed .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 RC3 as the fixed versions in the advisory published on October 25, 2026. Exposure affects applications that enable Brotli decompression or that explicitly use its APIs to process attacker-controlled data.

What did other organizations say about the technical scope?

SecurityWeek described CVE-2026-111497 as an out-of-bounds write in the Brotli decoder, with the ability to trigger memory corruption, memory content leaks, process crashes, or arbitrary code execution through specially crafted inputs. Red Hat said the flaw is in handling the block type switch in c/dec/decode.c, and that exposure can also occur through HTTP content negotiated with Content-Encoding: br or through Node.js APIs such as zlib and fetch(), even without directly calling a Brotli routine.

Which platforms were reviewed in parallel?

The vulnerability also affected Node.js and Python packages, which issued fixes before Microsoft, according to SecurityWeek. The University of California, Berkeley, warned that exploitation can lead to memory extraction, remote code execution, or denial of service when a server decompresses malicious Brotli data, and listed affected versions as Node.js 10.16.0 to 22.23.3, 23.0.0 to 24.22.0, and 25.0.0 to 26.12.0, plus the Python brotli extension 1.0.4 to 1.2.0 and the C++ libraries google.brotli/libbrotli 1.0.3 to 1.0.9.

Berkeley also recommended updating to Node.js 22.23.4, 24.22.1 or 26.12.1, Python brotli 1.2.1 and libbrotli 1.0.10 or 1.1.1. Tenable said Google published fixed Brotli versions on October 21, 2026, the same day Node.js publicly disclosed the vulnerability, and that to exploit the flaw the target must decompress an attacker-controlled Brotli stream.

Amazon Web Services recorded a Brotli update for Amazon Linux 2023 under advisory ALAS2023-2026-3334, published on October 24, 2026 and marked as fixed. Palo Alto Networks placed the scope at Google Brotli 1.0.3 through 1.2.0 across all platforms and warned that a remote unauthenticated attacker can corrupt adjacent decoder state memory, disclose sensitive content, trigger denial of service, or potentially execute arbitrary code through a manipulated Brotli stream.