Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution

If you use .NET versions 8 through 10, update your runtime immediately to prevent potential remote code execution.

Microsoft has issued out-of-band security updates for .NET 8, .NET 9, .NET 10, and .NET 11 RC3 to address critical vulnerabilities. The primary issue, CVE-2026-111497, is a buffer overflow flaw in the Brotli decompression algorithm used by .NET. This vulnerability could allow an unauthenticated attacker to read or corrupt process memory, potentially leading to information disclosure, denial of service, or privilege escalation across all platforms. A secondary vulnerability, CVE-2026-114148, affecting only Linux .NET tarballs for .NET 8 and .NET 9, and source-build tarballs for .NET 10 and .NET 11, could allow local attackers to modify files. Applications processing Brotli-compressed data via ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are at risk, though decompression is not enabled by default. .NET Framework is not affected. Additionally, fixes for previously released CVE-2026-70197 and CVE-2026-102870 are included.

The severity of CVE-2026-111497 highlights the ongoing challenges in securing third-party libraries that are deeply integrated into core development platforms like .NET. Brotli, a compression algorithm developed by Google, is now a standard part of Node.js and widely used in web contexts, meaning any vulnerability here has broad implications for applications handling compressed web traffic or data.

This incident underscores the need for continuous vigilance and rapid patching cycles in the software supply chain. Developers and organizations must prioritize updating their .NET environments to mitigate these risks, as unpatched systems could be vulnerable to significant security breaches, impacting data integrity and system availability.