Cybersecurity
Microsoft issues .NET patches for critical Brotli flaw
Microsoft released out-of-band security updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3 after disclosing a Brotli decoder flaw that could allow remote code execution.
- Microsoft released out-of-band security updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3.
- The company said CVE-2026-111497 came from an out-of-bounds write in Brotli decoding.
- Microsoft said applications could be affected when they processed Brotli data through ASP.NET Core, HttpClient or System.IO.Compression APIs.
- Microsoft said exploitation could cause crashes, memory leaks, remote code execution and remote privilege escalation on unpatched .NET systems with non-default configurations.
- Proof-of-concept exploits had already been posted on GitHub, but no malicious use in the wild had been reported.
Microsoft released emergency updates for several .NET versions after identifying CVE-2026-111497, a flaw in Brotli decoding. The company said the issue came from an out-of-bounds write in the decoder used for Brotli-compressed data.
Microsoft said applications could be affected if they processed Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression or System.IO.Compression APIs. It also said Brotli decompression was not enabled by default in standard .NET or ASP.NET Core installs.
The company said successful exploitation could let an attacker crash software, leak memory and, in some cases, execute code remotely. It also said unpatched .NET installations using non-default configurations could be exposed to remote privilege escalation.
Proof-of-concept exploits had appeared on GitHub, but Microsoft said there were no reports of malicious use in the wild. The company urged customers to apply the updates, and a tracking portal warned that patching the system Brotli library would not protect applications that bundled their own copy.
That portal advised blocking Brotli-compressed requests with a proxy or firewall, or disabling Brotli decoding until patches were in place. Microsoft’s updates covered .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3.
Named in this story
Companies
- Microsoft
- released the .NET security updates and issued the advisory
- was named as the maker of the Brotli compression algorithm
Products and systems
- Brotli
- was the compression algorithm and decoder at the centre of the flaw
- ASP.NET Core
- was one of the .NET components Microsoft said could process affected data
- HttpClient
- was one of the .NET components Microsoft said could decompress affected responses
- System.IO.Compression
- provided the Brotli APIs Microsoft said could be used by affected applications
- .NET 8
- received an out-of-band security update
- .NET 9
- received an out-of-band security update
- .NET 10
- received an out-of-band security update
- .NET 11 Release Candidate 3
- received an out-of-band security update
How the source tells it
The article was written as plain security reporting, with urgency coming from Microsoft’s emergency updates and its warnings about possible exploitation.
- Urgent patching the emergency out-of-band updates and advice to update as soon as possible
- Threat warning the listing of crashes, memory leaks, remote code execution and privilege escalation as possible outcomes