Microsoft Ships Out-of-Band .NET Updates for Brotli Overflow and Linux Tarball Flaws

TL;DR

Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2026-114148, a Linux tarball ownership flaw. The release also completes fixes for two October 13 bugs that were not fully patched.

Why It Matters

.NET runs a huge range of web apps, APIs and services. The Brotli bug can hit any app that decompresses untrusted Brotli data. Meanwhile, the tarball flaw quietly affects Linux servers that installed ASP.NET Core from archives.

The Brotli issue is not unique to .NET. It lives in Google’s Brotli decoder, versions 1.0.3 through 1.2.0, which Google’s CVE record scores CVSS 9.2. Node.js patched the same CVE in its October 21 security release.

How the Attacks Work

CVE-2026-111497: Brotli buffer overflow

According to the Microsoft .NET October 2026 out-of-band security updates post, the flaw “may allow an unauthenticated attacker to read or corrupt process memory.” That can lead to “information disclosure, denial of service, or elevation of privilege.”

Exposure depends on how an app handles compressed data. Apps are at risk if they process Brotli through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs. However, request and response decompression “are not enabled by default.” .NET Framework is not affected.

CVE-2026-114148: Linux tarball ownership

This flaw carries a CVSS 7.8 rating. Certain Linux tarballs shipped files with “unsafe ownership metadata.” When admins extract them while keeping numeric file ownership, a local account may end up controlling runtime files. Microsoft warns that such an account “may be able to modify files used by a more privileged application.”

For .NET 8 and 9, the ASP.NET Core runtime and targeting-pack tarballs are affected. For .NET 10 and 11, only source-build tarballs are affected. The ASP.NET Core security advisory GHSA-r6pf-x897-gm86 on GitHub carries further details.

Re-released fixes

Microsoft also re-released two advisories because the October 13 update “did not fully address these issues.” CVE-2026-70197 is a SocketAsyncEventArgs memory corruption bug rated CVSS 8.1. CVE-2026-102870 is a Blazor WebAssembly debugger flaw rated CVSS 8.8.

Exploitation status

Microsoft does not report exploitation in the wild for any of these flaws. No public proof-of-concept has been confirmed, and none appears in CISA’s KEV catalog.

Affected Versions

• .NET 8: before 8.0.33
• .NET 9: before 9.0.22
• .NET 10: before 10.0.14
• .NET 11: previews through RC2

Patch and Mitigation Steps

Install this .NET security update: 8.0.33, 9.0.22, 10.0.14 or 11.0 RC3. Then follow the steps for your deployment type.

• Framework-dependent apps: install the new runtime and restart the app.
• Self-contained apps: rebuild and republish, since a host update does not touch the bundled runtime.
• Containers: rebuild and redeploy with updated .NET images.
• ASP.NET Core tarball users on .NET 8 and 9: install the refreshed tarball into a new, empty directory.

Do not extract over the old install

For the tarball flaw, a simple upgrade is not enough. Microsoft says extracting over an existing installation “does not by itself correct the existing installation.” Instead, install fresh without restoring archive ownership, then point apps at the new directory. Use dotnet –list-runtimes to confirm which runtimes each machine carries. Finally, check self-contained apps and containers separately, because they ship their own runtime and need their own .NET security update.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.