Microsoft patches Brotli, .NET tarball vulnerabilities

Key Takeaways

• Microsoft has issued out-of-band security updates for .NET to address two critical vulnerabilities.
• The flaws include a buffer overflow in Brotli decompression (CVE-2026-111497) affecting all platforms and unsafe ownership settings in Linux .NET tarballs (CVE-2026-114148).
• Affected versions span .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3.
• The update also finalizes patches for two other vulnerabilities (CVE-2026-70197 and CVE-2026-102870) that were not fully resolved in earlier October releases.
• Users are strongly advised to update immediately to prevent potential data exposure, privilege escalation, or application crashes.

Microsoft Patches Critical .NET Vulnerabilities in Emergency Out-of-Band Release

Microsoft has deployed urgent out-of-band security updates for its .NET platform, addressing a significant buffer overflow flaw within its Brotli decompression implementation and a separate issue concerning insecure ownership settings in Linux distribution archives. The patches, released on October 25, 2026, are crucial for users running .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3.

This emergency release also serves to complete fixes for two vulnerabilities—CVE-2026-70197, related to SocketAsyncEventArgs memory corruption, and CVE-2026-102870, impacting the Blazor WebAssembly debugger—which were not entirely remediated in the October 13 update. This means even organizations that applied earlier monthly .NET updates must install these new patches.

Brotli Decompression Buffer Overflow (CVE-2026-111497)

The first critical vulnerability, identified as CVE-2026-111497, resides in how .NET handles Brotli-compressed data across all supported platforms. An unauthenticated attacker could exploit a buffer overflow to read or corrupt process memory, potentially leading to data exposure, application crashes, or unauthorized privilege escalation.

Applications are vulnerable if they actively process Brotli-compressed content. This includes scenarios involving ASP.NET Core request decompression, automatic HttpClient response decompression, or direct use of System.IO.Compression Brotli APIs. Microsoft emphasizes that request and automatic response decompression features are not enabled by default, and the older .NET Framework is not impacted by this specific flaw.

Organizations must assess their application configurations to determine exposure, focusing on services that explicitly handle Brotli content rather than assuming uniform risk across all .NET deployments.

Unsafe Linux Tarball Ownership (CVE-2026-114148)

The second vulnerability, CVE-2026-114148, targets Linux .NET tarballs, which package ownership metadata for contained files. Microsoft warns that this flaw could enable a local attacker to modify files and subsequently achieve elevated privileges. This issue is specific to Linux environments.

For .NET 10 and .NET 11, only source-build tarballs are affected. However, for .NET 8 and .NET 9, the vulnerability also extends to ASP.NET Core installations obtained via ASP.NET Core tarballs. Users in this latter group need updated archives even if they do not build .NET from source.

The release also completes fixes for CVE-2026-70197, involving SocketAsyncEventArgs memory corruption, and CVE-2026-102870, involving the Blazor WebAssembly debugger. These affect .NET 8 through 11 and .NET 10 through 11, respectively.

Required Updates and Deployment Considerations

The patched versions are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3. Users currently on .NET 11 RC2 must upgrade to RC3.

Deployment procedures vary based on the application type:

• Framework-dependent applications: Require the updated runtime and an application restart.
• Self-contained applications: Must be rebuilt and republished, as installing a newer host runtime does not replace their bundled runtime.
• Containerized applications: Require rebuilding and redeploying using updated .NET images.
• Source-build users: Must obtain refreshed artifacts and rebuild packages.

Administrators can check installed runtimes using dotnet --list-runtimes but must verify self-contained applications and containers separately. Microsoft’s .NET deployment documentation provides comprehensive guidance for selecting the appropriate update path for each application.

What You Should Do

• Immediately apply the out-of-band security updates for .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3.
• For framework-dependent applications, update the runtime and restart the application.
• For self-contained applications, rebuild and republish them with the updated runtime.
• For containerized applications, rebuild and redeploy your containers using the latest .NET images.
• If using .NET on Linux, ensure you obtain refreshed tarballs, especially if you build from source or use ASP.NET Core tarballs for .NET 8 and 9.
• Review your application configurations to identify any services that handle Brotli-compressed data, particularly via ASP.NET Core request decompression or HttpClient automatic response decompression.
• Verify the successful application of patches across your environment, including self-contained applications and containers, as instructed by Microsoft’s deployment documentation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.