Key Takeaways:
- Microsoft releases emergency updates to fix a critical security flaw linked to Google’s Brotli data compression technology.
- The flaw could let attackers access or damage computer memory without signing in.
- The updates cover several .NET versions, including .NET 8, .NET 9, and .NET 10.
Microsoft released emergency security updates on Sunday to fix a critical memory-related flaw in its .NET software framework. The problem is linked to Google’s Brotli algorithm, which software uses to decompress compressed data.
Microsoft Issues Emergency Fix for Brotli Security Flaw
Microsoft released urgent security updates to fix a serious flaw tracked as CVE-2026-111497. The issue involves a software error in Brotli’s decompression process that can write data outside its allocated memory space.
The flaw could allow an attacker to manipulate a program’s memory by sending specially crafted compressed data. If exploited, it could expose information, corrupt memory, disrupt services, or let an attacker gain higher levels of access.
The emergency updates cover .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3, a pre-release version for testing. Microsoft urged developers and system administrators to install the updated versions to protect affected applications.
Security Updates Fix Other Software Flaws
Alongside the Brotli issue, Microsoft fixed another security flaw tracked as CVE-2026-114148. This bug involves how Linux versions of .NET handle file ownership information in TAR archives. It could allow a local attacker to gain higher levels of access.
The emergency release also includes updated fixes for two issues covered in Microsoft’s October 13 Patch Tuesday release. These include a memory-related flaw in SocketAsyncEventArgs and a code injection flaw affecting Blazor WebAssembly debugging tools.
Microsoft said the earlier updates had not fully fixed those two problems. The latest release provides further fixes for the affected .NET development tools and environments.
More Info: Microsoft Patches Defender Vulnerabilities Exploited In Active Attacks
Developers Must Update Their Applications and Systems
Microsoft provided instructions for developers updating their software and servers. Organizations running applications that rely on an installed .NET runtime must install the updated runtime and restart affected services.
Applications that include their own runtime, as well as those running in containers, need separate checks. Developers must rebuild and republish these applications with the updated packages to ensure they include the fixes.
Microsoft confirmed that standard .NET Framework installations are not affected by the main Brotli flaw. However, system administrators should check their active .NET deployments and apply the relevant updates to protect their systems.
