Microsoft patches critical .NET flaw that risks memory corruption

Microsoft has issued out-of-band security updates for its .NET platform to address a critical buffer overflow and two other related flaws, with patches available for .NET releases 8, 9, 10 and 11 Release Candidate 3 as of 25 October. The updates come after two newly disclosed vulnerabilities and a re-release of fixes from the October Patch Tuesday cycle. A single update is provided for each affected .NET version, and .NET 11 RC2 users should move to RC3 to receive the fixes.

One flaw, CVE-2026-111497, sits in the Brotli decompression path used by .NET and can allow an unauthenticated attacker to read or corrupt process memory, potentially causing information disclosure, denial of service or elevation of privilege. It affects Brotli libraries in Google Brotli 1.0.3 through 1.2.0, as well as .NET across all operating systems via ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO[.]Compression Brotli APIs.

The second vulnerability, CVE-2026-114148, enables local privilege escalation via unsafe ownership metadata in affected .NET tarballs and affects Linux builds on .NET 7–11; for .NET 10 and 11, it concerns source-build tarballs, while for 8 and 9 it also impacts ASP.NET Core tarballs. CVEs CVE-2026-70197 (memory corruption) and CVE-2026-102870 (code injection) are re-issued fixes from the October Patch Tuesday for .NET 8–11 and for .NET 10–11 respectively.

Microsoft’s remediation guidance advises installing the updated runtimes, rebuilding and redeploying self-contained applications and containers with the updated runtimes, obtaining updated source-build artifacts, and for ASP.NET Core tarball users on .NET 8 and 9, updating via the refreshed ASP.NET Core tarball.