Microsoft issues out of band .NET fixes for four flaws

Microsoft has issued an out-of-band security update for .NET across multiple major releases—8, 9, 10, and the Release Candidate 3 of 11—to fix two critical flaws and to re-address two issues from an earlier October batch. The fixes include CVE-2026-111497, a Brotli decompression buffer overflow with a CVSSv4 score of 9.2 (Critical), and CVE-2026-114148, a Linux tarball ownership flaw rated 7.8.

Microsoft states the Brotli flaw could allow an unauthenticated attacker to read or corrupt process memory, potentially enabling information disclosure, denial of service, or privilege escalation, depending on how an app handles Brotli data. The tarball flaw affects ASP.NET Core tarballs on .NET 8, 9, 10, and 11 in various packaging scenarios, noting that extraction over an existing installation is not sufficient to remediate.

Microsoft also re-released advisories on two previously disclosed issues: CVE-2026-70197, a SocketAsyncEventArgs memory corruption bug rated CVSS 8.1, and CVE-2026-102870, a Blazor WebAssembly debugger flaw CVSS 8.8. The exploitation status in the disclosed materials shows no confirmed in-the-wild exploitation for these flaws, and no public PoC is reported; however, one flaw is listed as exploited in the TL;DR, and patches are available.

Affected versions are .NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14, and .NET 11 previews through RC2. Users are advised to update to 1.0.10, 1.1.1, 1.2.1, or 10.0.403 (or 11.0 RC3) and to follow deployment-specific remediation steps, including fresh tarball installation for ASP.NET Core tarball users on .NET 8 and 9 and re-deploying containers.