Microsoft has released out-of-band security updates for .NET to address a critical Brotli decompression buffer overflow and unsafe ownership metadata in Linux .NET tarballs. Published October 25, 2026, the fixes cover .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 and complete remediation for issues that were not fully resolved in the October 13 updates. Microsoft urges administrators and development teams to apply these updates as soon as possible.
What Microsoft patched
Microsoft’s emergency release addresses two primary problems. The first, tracked as CVE-2026-111497, is a buffer overflow in Brotli decompression used across .NET platforms. An attacker could exploit this flaw to read or corrupt process memory, which may lead to data exposure, application crashes, or privilege escalation. Applications that process Brotli-compressed data — for example via ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs — may be exposed if they are configured to accept such content.
The second issue, CVE-2026-114148, affects unsafe ownership metadata in certain Linux .NET tarballs. Because these archives contain ownership information for packaged files, a flaw here could let a local attacker modify files and gain higher privileges. For .NET 10 and .NET 11 the problem affects source-build tarballs only; for .NET 8 and .NET 9 it also affects ASP.NET Core tarballs, meaning some users who don’t build from source may still need refreshed archives.
Additional fixes shipped in this release complete remediation for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) and CVE-2026-102870 (Blazor WebAssembly debugger issue), covering various .NET versions as noted in Microsoft’s advisory.
Who and what is affected
– Platforms: The Brotli issue impacts .NET across platforms; the unsafe tarball ownership issue is specific to Linux tarballs.
– Versions: Patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3. Users on .NET 11 RC2 are urged to move to RC3.
– Application types: Framework-dependent applications require the updated runtime and an application restart. Self-contained applications must be rebuilt and republished because a newer host runtime does not replace a bundled runtime. Containerized applications must be rebuilt and redeployed using updated .NET images. Source-build users should obtain refreshed artifacts and rebuild packages.
Why this matters
These vulnerabilities are not theoretical — memory corruption and ownership-metadata flaws can lead to serious outcomes: sensitive data exposure, denial of service from crashes, or local privilege escalation on Linux. Because the October 13 release did not fully resolve these flaws, teams that installed those earlier updates cannot assume they are fully protected without applying the new out-of-band fixes.
What administrators and developers should do
– Prioritize updates: Apply the patched runtimes immediately where applicable.
– Identify exposure: Determine which services actually accept Brotli-compressed content; request decompression and automatic response decompression are not enabled by default, so risk varies by configuration.
– Rebuild where required: Rebuild and republish self-contained applications and container images. Source-build users must fetch refreshed artifacts and rebuild packages.
– Verify installed runtimes: Check installed runtimes (for example, with dotnet –list-runtimes) and confirm which applications are framework-dependent versus self-contained.
– Move to RC3 if applicable: Users on .NET 11 RC2 should upgrade to RC3.
Deployment details and checks
Microsoft’s advisory highlights important deployment differences: installing an updated host runtime secures framework-dependent apps after a restart, but does not alter the runtime bundled into self-contained apps. Container images likewise require rebuild and redeploy cycles to pick up patched runtimes. For the tarball ownership issue, note the difference in affected artifacts: source-build tarballs for .NET 10/11 and additional ASP.NET Core tarballs for .NET 8/9.
Takeaway
This out-of-band release underscores how configuration details and deployment models influence exposure and remediation effort. Teams should treat these updates as urgent, confirm which applications accept Brotli content, rebuild and redeploy self-contained and containerized apps where needed, and verify runtime versions across environments to ensure the fixes are fully applied.
Licensed under CC BY-ND 4.0 International