Microsoft shipped out-of-band updates on Sunday, October 25, 2026, for .NET 8, 9 and 10 and .NET 11 Release Candidate 3. They fix CVE-2026-111497, a buffer overflow in Google's Brotli compression library, which OpenAI's Codex Security team reported to Node.js. Visual Studio and PowerShell builds are covered too, and other tools that bundle Brotli (Node.js, Python packages, Envoy, Istio) are shipping fixes.
Severity is reported differently. Microsoft rates it critical for .NET and Visual Studio, and TechJuice and Forbes cite a 9.2 score, while daily.dev cites 8.1 on CVSS v3.1. Microsoft lists exploitation as "more likely", and public proof-of-concept code exists, though no attacks in the wild had been reported at disclosure.
The exposure is narrower than the headline suggests. Microsoft says a standard .NET or ASP.NET Core install isn't affected out of the box. Risk comes from ASP.NET Core request decompression, automatic response decompression in HttpClient, or the System.IO.Compression Brotli APIs. Microsoft says .NET Framework isn't affected. If you use any of those, update as soon as you can; if you can't, Microsoft's stopgaps include blocking Brotli-compressed incoming traffic.
A separate .NET release the same day fixes CVE-2026-114148, an ownership flaw in Linux .NET tarballs.
Also discussed here:
- Cyber agencies tell websites to patch two critical PHP flaws or go …
🕒 As of October 2026
