Microsoft releases emergency .NET update to fix critical Brotli security flaw

Microsoft has released an emergency patch for a critical Brotli decompression flaw affecting multiple .NET versions, warning of potential memory corruption, information disclosure and privilege escalation.

Microsoft has issued an emergency out-of-band security update following the discovery of a critical vulnerability in Google's Brotli decompression algorithm, which is used by .NET. The flaw affects .NET 8, .NET 9 and .NET 10, as well as .NET 11 Release Candidate 3, across Windows, macOS and Linux platforms.

A senior program manager for Microsoft .NET confirmed in an October 25 announcement that the vulnerability, discovered on October 22, is a buffer overflow flaw that could allow an “unauthenticated attacker to read or corrupt process memory”. Potential consequences include information disclosure, denial of service and privilege escalation.

The official Common Vulnerabilities and Exposures (CVE) database entry for CVE-2026-11497 states that exploiting the vulnerability could also potentially allow an attacker to execute arbitrary code using a Brotli-compressed stream.

Microsoft confirms impact of CVE-2026-11497

The Microsoft Security Response Center (MSRC) confirmed that the vulnerability has been publicly disclosed and rated as critical based on its analysis. However, there is no evidence of exploitation so far.

Microsoft has noted that request decompression and automatic response decompression are not enabled by default. The .NET Framework is also not affected by CVE-2026-11497.

Microsoft advises application updates

Microsoft has advised users of framework-dependent applications to install the updated runtime for the .NET version their application targets and then restart the application.

For self-contained applications, users should rebuild and redeploy them with the updated runtime. Installing a newer runtime on the host machine will not update the runtime bundled with a self-contained application.

How the vulnerability works

The problem lies in how the Brotli decoder handles a particular type of compressed data. Normally, software should reject invalid data, but the decoder can mistake an invalid instruction for a signal that it needs more data to finish processing a file.

It then continues writing incoming data into a small, eight-byte buffer, even when the data exceeds the buffer's capacity.

This can corrupt memory and cause the affected application to stop working, potentially disrupting a service or website. Under exploitable conditions, the flaw could also expose sensitive information or allow an attacker to execute malicious code on the affected system. This is known as remote code execution (RCE).

microsoft releases emergency net update to fix critical brotli security flaw