If your business runs software on .NET, there is a patch to schedule this week. On 25 October 2026 Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, plus .NET 11 Release Candidate 3, to fix CVE-2026-111497. It is the same Brotli decoder flaw we covered in our Node.js security release guide and our Python, Bun and Envoy follow-up. Microsoft describes it as a buffer overflow in .NET's use of Brotli decompression that may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege. BetaNews reports Microsoft rates it Critical.
Are you actually exposed?
Microsoft says an application may be affected if it processes Brotli-compressed data through one of three routes:
- ASP.NET Core request decompression
- HttpClient automatic response decompression
- the System.IO.Compression Brotli APIs
Request decompression and automatic response decompression are not enabled by default. So a plain ASP.NET Core site is not automatically at risk, but any app that turned those features on, or calls Brotli APIs directly, is in scope. .NET Framework is not affected. Your developers can search the code for those three routes in an hour or so.
Which versions fix it
| .NET version | Fixed in |
|---|---|
| .NET 8 | 8.0.33 |
| .NET 9 | 9.0.22 |
| .NET 10 | 10.0.14 |
| .NET 11 | Release Candidate 3 (RC2 users must update) |
The same release carries a fix for CVE-2026-114148, a Linux tarball ownership issue that could let a local attacker gain elevated privileges. It matters mainly if you install .NET from tarballs or build it from source. Microsoft also re-released fixes for two earlier issues, CVE-2026-70197 and CVE-2026-102870, because its 13 October release did not fully address them, so apply this update even if you installed the October 13 one.
What to do, by how you deploy
- Framework-dependent apps: install the updated runtime for your target version, then restart the app.
- Self-contained apps: rebuild and republish. Installing a newer runtime on the server does not change the runtime bundled inside your app.
- Containers: rebuild on an updated .NET image and redeploy.
- Source-build or ASP.NET Core tarball users (.NET 8 and 9): get the refreshed tarball or source-build artifacts.
Check what a machine has with dotnet --list-runtimes. Microsoft notes that self-contained and container deployments must be checked separately because they carry their own runtime. On Windows you may be asked to restart if files are in use, and Microsoft recommends closing .NET-based applications before updating.
A short checklist for owners
- List every .NET application you run, including old internal tools and anything a vendor built for you.
- Ask each developer or vendor which .NET version it targets and how it is deployed.
- Patch internet-facing services first, then internal ones.
- Confirm the fixed version after the restart or redeploy, not just after the install.
- If you cannot patch today, find out whether Brotli request or response decompression is on, and turn it off where it is not needed. Microsoft's post does not offer a separate workaround, so treat this as a stopgap only.
Keeping runtimes current is routine work that a website and application maintenance plan should cover, and it is a good reason to ask any software vendor how they handle security updates. If you want help auditing what you run, see our services or get in touch.
Sources
- Microsoft .NET Blog: .NET October 2026 Out-of-Band Security Updates, 25 October 2026
- Microsoft Support: .NET 10.0 Update, 25 October 2026
- BetaNews: Microsoft releases emergency security updates for .NET, 26 October 2026
- CVE.org record for CVE-2026-111497
Last reviewed 26 October 2026. This is general security information, not a guarantee of protection.
