Microsoft has released emergency out-of-band security updates for .NET to patch a critical flaw in Google’s Brotli compression decoder, urging users to update as soon as possible. According to BleepingComputer and The Register, both reporting Microsoft’s October 25 advisory, the updates cover .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3, closing CVE-2026-111497, an out-of-bounds write rated 8.1 under CVSS v3.1 that lets an unauthenticated attacker corrupt process memory. Proof-of-concept exploits are already public, though neither outlet reports attacks in the wild, and Microsoft rates exploitation as more likely. The patches complete the latest round of fixes for a flaw that has forced nearly every major runtime to ship updates in the past week.
The Emergency Updates
Microsoft published the out-of-band updates on Sunday, October 25, outside its normal monthly patch cycle. Senior program manager Rahul Bhandari said the buffer overflow in Brotli, tracked as CVE-2026-111497, could allow an unauthenticated attacker to read or corrupt process memory, potentially causing information disclosure, denial of service, or elevation of privilege. The flaw is also known as Broccoli2Shell, Node2Shell and HTTP2Shell.
The fixed versions are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3, covering both the SDK and the runtime for each line. Microsoft advised users to update as soon as possible, and The Register reports that the company’s exploitability assessment for the flaw reads “Exploitation More Likely.” The updates follow similar emergency patches from Node.js, Python, Bun, Envoy and Istio, all of which bundle or depend on the same Brotli code.
Who Is At Risk
Microsoft said applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. The trigger is a maliciously crafted Brotli-compressed stream: BleepingComputer reports it lets unprivileged attackers cause crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli binaries or libraries.
There is one important limit on the exposure. Microsoft said Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET. The advisory adds that attackers can also remotely escalate privileges on unpatched .NET installations using non-default configurations, so risk concentrates in deployments that deliberately switched decompression on.
Exploitation Status And Mitigations
Proof-of-concept exploits for the flaw have already been published on GitHub, according to BleepingComputer, and The Register reports that security experts have cobbled working exploits together. Neither outlet reports malicious exploitation in the wild so far, and The Register notes there is nothing to suggest criminals are using the exploits in successful attacks. That gap between public exploits and observed attacks is exactly the window Microsoft’s urgent wording is aimed at closing.
For teams that cannot patch immediately, BleepingComputer reports the recommended mitigations: block incoming Brotli-compressed requests using a proxy or firewall, or disable Brotli decoding until the patch can be applied. A tracking portal for the flaw warns that updating the system Brotli library does not fix applications that bundle their own copy, so each deployment needs its own check. The Register also cites Wiz researcher Merav Bar, who said 91 percent of cloud environments rely on vulnerable components and 82 percent have publicly exposed Node.js instances.
Why It Matters
The .NET patches matter because of where .NET sits: behind enterprise web applications, APIs and internal services that process untrusted input every day. A flaw that needs no credentials and arrives inside ordinary compressed traffic is the kind attackers scan for first once exploits are public, and Microsoft’s own “more likely” assessment removes any doubt about the direction of travel. The opt-in nature of .NET decompression narrows the exposed set, but any team that enabled it for performance has a live, remotely triggerable path into its services until it patches.
The episode also shows how a single shared library turns into an industry-wide scramble. The same decoder flaw has now forced patches across runtimes, proxies and service meshes, and researchers have extended the exploit path further still: JFrog built an exploit affecting FFmpeg through the JPEG XL image path, and the same researchers said Apache Arrow is affected too, with denial of service as the outcome. Each new downstream finding widens the list of software needing checks, which is why the advice to patch now carries real weight.
Background
The flaw was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, and OpenAI later explained the root cause had been fixed in the Brotli source code in February, but was not then known to be a security vulnerability, and no newer Brotli release existed. GEroundtable covered OpenAI’s earlier Brotli disclosure on October 24, and The Register notes this flaw went slightly under the radar because its disclosure closely aligned with the PHP2Shell episode, the critical PHP flaws disclosed the same week.
Source: BleepingComputer: Microsoft emergency .NET patches; The Register: Microsoft .NET security fixes
0 Comments