Microsoft Issues Emergency .NET Updates for Brotli Flaw and Linux Privilege Escalation

Microsoft .NET security updates released on October 25, 2026, address a serious Brotli decompression vulnerability and a separate Linux file-ownership flaw that could allow attackers to gain elevated privileges under affected conditions.

The out-of-band security release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft recommends updating affected installations as soon as possible rather than waiting for the next regular servicing cycle.

The two main vulnerabilities are CVE-2026-111497, involving memory corruption during Brotli decompression, and CVE-2026-114148, involving unsafe ownership metadata in certain Linux .NET distribution archives.

The update also corrects two earlier security fixes that Microsoft’s October 13 release did not fully address.

For developers and DevOps teams, the important question is not simply whether .NET is installed. Exposure depends on which runtime an application uses, whether it processes untrusted compressed data, and how its Linux runtime packages were obtained and installed.

Self-contained applications and container deployments require particular attention because updating a shared runtime on the host does not automatically replace runtime components bundled inside deployed applications.

Here are the confirmed vulnerabilities, affected configurations, fixed versions, and practical steps administrators should take.

For broader enterprise remediation guidance, see our CVE and Vulnerability Exploits Security Hub.

Key Findings From Microsoft’s Emergency .NET Security Updates

• Release date: October 25, 2026, outside Microsoft’s normal monthly servicing schedule.
• Brotli vulnerability: CVE-2026-111497 can allow memory corruption when affected applications decompress attacker-controlled Brotli content.
• Linux tarball issue: CVE-2026-114148 can permit local privilege escalation because of unsafe ownership metadata in certain .NET distribution archives.
• Additional corrections: Updates also address incomplete October 13 fixes for CVE-2026-70197 and CVE-2026-102870.
• Affected release lines: .NET 8, 9, 10, and supported .NET 11 preview builds, with vulnerability-specific conditions.
• Patched releases: .NET 8.0.33, 9.0.22, 10.0.14, and .NET 11 Release Candidate 3.
• Deployment action: Update shared runtimes, rebuild self-contained applications, and redeploy containers using patched images.

Why Microsoft Released Emergency .NET Security Updates

Microsoft issued the updates as an out-of-band release rather than waiting for another scheduled patch cycle.

This decision reflects the seriousness of the vulnerabilities and the need to correct security issues affecting applications and development environments.

The emergency release addresses two newly identified vulnerabilities while also improving fixes included in the company’s October 13 security updates.

The most broadly relevant issue is the Brotli decoder vulnerability.

Brotli is a compression format used by websites and applications to reduce the size of transmitted data.

When a program decompresses content, it must interpret compressed data supplied by a file, network response, or other input source.

If the decompression implementation mishandles specially crafted content, the result may be memory corruption.

The second major issue concerns ownership metadata stored in certain Linux tarball distributions.

Unlike the Brotli vulnerability, the tarball issue requires a local attack context and affects particular distribution and installation workflows.

These differences are important because neither flaw should be described as a universal remote-code-execution vulnerability affecting every .NET application.

CVE-2026-111497: Brotli Decoder Memory Corruption

CVE-2026-111497 is a vulnerability affecting .NET’s use of the Brotli decompression algorithm.

Microsoft identifies the underlying problem as a buffer overflow that can allow an unauthenticated attacker to read or corrupt process memory when vulnerable application code processes attacker-controlled compressed data.

Possible consequences include information disclosure, denial of service, and elevation of privilege.

The vulnerability affects supported .NET platforms where an affected decoder processes malicious Brotli content.

However, simply installing .NET does not automatically mean an attacker can reach this code.

An application must use a vulnerable decompression path and process untrusted input under the relevant conditions.

Which .NET Features Can Be Exposed?

Microsoft identifies three important application patterns:

• ASP.NET Core request decompression: Applications that enable handling of Brotli-compressed incoming HTTP requests.
• HttpClient automatic response decompression: Applications configured to automatically decode Brotli-compressed responses.
• System.IO.Compression: Applications directly using Brotli decompression APIs such as BrotliStream or BrotliDecoder with untrusted data.

ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default.

Therefore, teams should inspect their application configuration rather than assuming that every ASP.NET Core service exposes the vulnerable functionality.

The issue does not affect .NET Framework, according to Microsoft’s official advisory.

CVE-2026-114148: Linux .NET Tarballs Could Enable Privilege Escalation

The second major vulnerability is CVE-2026-114148, which involves unsafe file-ownership metadata in certain Linux .NET distribution archives.

Linux file ownership helps determine which users and processes can modify or execute files.

When software installation archives contain incorrect ownership metadata, installing them under particular conditions can create unintended access permissions.

Microsoft warns that affected installations may allow a local attacker to modify files and gain elevated privileges.

This is a local elevation-of-privilege issue. It should not be described as allowing arbitrary unauthenticated remote access.

Which Linux Installations Are Affected?

The affected distribution types differ across .NET releases.

For .NET 8 and .NET 9, administrators using affected ASP.NET Core runtime tarballs must update even if they did not build .NET from source.

For .NET 10 and .NET 11, Microsoft identifies the source-build tarball workflow as the relevant exposure.

Ordinary Microsoft-published .NET runtime and SDK tarballs are not affected by this ownership issue according to Microsoft’s .NET 8 servicing guidance.

Administrators should consult the official advisory to determine whether their exact packages and installation methods are affected.

Patched .NET Versions: What Administrators Must Install

Microsoft has published corrected runtime versions for the affected branches.

For applications using NativeAOT or explicitly referenced runtime packages, upgrading the installed host runtime may not be sufficient.

Those applications may require updated build tools, package references, and a new deployment artifact.

The correct remediation depends on how the application was built and distributed.

Microsoft Also Corrected Two Incomplete October Security Fixes

The October 25 update does more than address the Brotli and tarball issues.

Microsoft also reissued fixes associated with CVE-2026-70197 and CVE-2026-102870.

CVE-2026-70197: SocketAsyncEventArgs Memory Corruption

This vulnerability concerns memory corruption involving .NET socket operations.

Microsoft’s emergency updates refresh the affected releases because the October 13 remediation did not fully resolve the issue.

Organizations that installed the earlier monthly security update should not automatically assume that the additional October 25 corrections are unnecessary.

CVE-2026-102870: Blazor WebAssembly Debugger

This vulnerability concerns the Blazor WebAssembly debugging functionality.

Microsoft included additional corrections for affected .NET 10 and .NET 11 releases.

In environments using explicitly referenced Blazor packages, application dependencies may also require attention.

Administrators should review the applicable product advisories rather than assuming that updating a shared runtime resolves every affected NuGet dependency.

Is the Microsoft Brotli Flaw the Same as the Node.js Vulnerability?

The Brotli decoder issue is connected to a vulnerability also addressed in the October 2026 Node.js security release.

The shared identifier is CVE-2026-111497.

However, the deployment impact and vendor remediation differ.

Node.js published fixed runtime releases for its supported branches, while Microsoft issued separate patches for the .NET ecosystem.

Updating Node.js does not update .NET applications.

Likewise, installing Microsoft’s .NET patches does not repair an affected Node.js runtime.

Our earlier Node.js security update report covering 10 vulnerabilities explains the October Node.js fixes separately.

Organizations operating both technologies should assess each runtime independently.

How to Check Your Installed .NET Versions

Administrators can begin with non-destructive runtime inventory commands.

1. List Installed .NET Runtimes

dotnet --list-runtimes

This displays the .NET runtimes installed and registered on the system.

Compare installed versions against the fixed-release table.

Remember that this command does not inspect every runtime bundled inside self-contained applications.

2. Check the Installed SDKs

dotnet --list-sdks

SDK versions matter when rebuilding affected applications, NativeAOT executables, or development artifacts.

Do not assume that installing a current SDK automatically updates older deployed applications.

3. Check the Active CLI Environment

dotnet --info

Review the architecture, installation directories, and SDK information.

Systems may have multiple runtime versions installed side by side.

4. Identify Containerized Applications

If an application runs inside Docker, inspect the runtime from the relevant container environment.

docker exec <container-name> dotnet --list-runtimes

Replace the placeholder with the actual container name.

This command works only where the application image contains the required .NET host and command-line functionality.

For minimal, self-contained, or NativeAOT images, inspect build metadata, image digests, manifests, and application deployment records instead.

How to Install the Microsoft .NET Emergency Security Updates

The remediation procedure depends on the application’s deployment model.

Framework-Dependent Applications

Install the applicable patched shared runtime.

Restart the affected service or application so it loads the updated runtime.

Verify the active runtime version after restarting.

Self-Contained Applications

Rebuild and republish the application using an updated .NET runtime and SDK.

Installing a patched runtime on the host does not replace the runtime bundled inside an existing self-contained deployment.

Docker and Kubernetes Deployments

Use updated Microsoft .NET base images when rebuilding workloads.

Redeploy the rebuilt containers and verify that the new workloads run the expected images.

Replacing the image reference in a deployment configuration is not sufficient if old containers remain active.

For Kubernetes, use your normal controlled rollout procedures and validate workload health after deployment.

Linux Source-Build Consumers

Obtain corrected source-build artifacts and rebuild affected packages.

Check the official advisory for the applicable patched artifact versions.

ASP.NET Core Linux Tarball Installations

Administrators using affected .NET 8 or .NET 9 ASP.NET Core tarballs should replace them with the corrected distributions.

Review the file-ownership issue separately from runtime decompression exposure.

Can a WAF Prevent CVE-2026-111497 Exploitation?

A web application firewall can provide defense-in-depth for some malformed requests, but Microsoft does not identify a WAF rule as a complete remediation for the Brotli vulnerability.

The affected decoder may process data received through multiple application paths.

For example, an application can use HttpClient or direct compression APIs without exposing the corresponding input through the same inbound web firewall.

Microsoft advises administrators who cannot immediately patch to avoid decompressing attacker-controlled Brotli content.

Where Brotli request decompression is already enabled, administrators can temporarily remove the Brotli provider from their existing configuration.

Where HttpClient automatic response decompression is already configured, they can remove Brotli from the allowed decompression methods.

These changes may affect application behavior and should be tested before production deployment.

Do not introduce request decompression or automatic response decompression merely to apply these workarounds.

Installing the patched runtime remains the recommended permanent fix.

How Security Teams Should Investigate Possible Exposure

The public Microsoft guidance identifies the vulnerabilities and fixed versions, but it does not establish that every affected application has been successfully exploited.

Teams investigating suspicious activity should review evidence in the context of their applications.

• Brotli processing: Determine where untrusted compressed data enters the application.
• Application crashes: Review unusual process termination or memory-corruption events associated with compressed input.
• HTTP configuration: Inspect request decompression and automatic response decompression settings.
• Linux installations: Review the provenance of affected runtime and targeting-pack tarballs.
• File ownership: Investigate unexpected ownership or modification permissions on sensitive installed files.
• Containers: Identify old application images that still contain vulnerable runtime components.
• Application dependencies: Check separately packaged runtime or NuGet dependencies that require updating.

A crash, package version, or configuration setting alone does not prove a successful intrusion.

If compromise is suspected, preserve relevant logs and follow the organization’s incident-response process.

Confirmed vs Unknown: Microsoft .NET Security Updates

Confirmed by Microsoft

• Out-of-band .NET security updates were released October 25, 2026.
• CVE-2026-111497 affects vulnerable Brotli decompression paths.
• CVE-2026-114148 affects ownership metadata in specified Linux .NET tarballs.
• The release also refreshes incomplete fixes for CVE-2026-70197 and CVE-2026-102870.
• Fixed runtime versions include 8.0.33, 9.0.22 and 10.0.14, alongside .NET 11 RC3.
• Framework-dependent applications need updated shared runtimes and a restart.
• Self-contained applications need rebuilding and republishing.
• Container workloads need updated images and redeployment.
• .NET Framework is not affected by the Brotli vulnerability described in this release.

Unknown or Not Universally Established

• That every ASP.NET Core application uses vulnerable Brotli decompression.
• That every .NET installation downloaded through an official archive is affected by the Linux ownership flaw.
• The number of production systems successfully compromised through these vulnerabilities.
• That a WAF alone provides complete mitigation.
• That updating a host runtime automatically fixes every self-contained application.
• That the Node.js and .NET runtime patch versions are interchangeable.

CyberUpdates365 Analysis

Microsoft’s emergency .NET security updates highlight why vulnerability management must consider both software components and deployment methods.

The Brotli issue affects a widely used compression technology, but the practical exposure depends on whether applications process attacker-controlled data through the affected decoder.

The Linux tarball issue presents a different problem. Its risk comes from installation artifacts and ownership metadata rather than from the processing of hostile network requests.

These are two different security boundaries requiring different investigation methods.

For DevOps teams, the most important operational lesson concerns application packaging.

A framework-dependent .NET application can often benefit from a patched shared runtime once the service is restarted.

A self-contained application, however, carries its runtime with it. The package must be rebuilt and redeployed.

Container images create a similar challenge: a patched base image does not update an already-running application container.

This makes deployment inventory essential.

Organizations need to know not only which applications depend on .NET, but also how they are built, packaged, distributed and started.

The re-release of two earlier security fixes reinforces another lesson: applying a monthly update does not always complete remediation if the vendor later publishes an additional correction.

Security teams should monitor follow-up advisories, verify the actual deployed versions, and keep clear evidence that required updates have reached production workloads.

The central takeaway is that emergency patching succeeds only when the corrected runtime or package reaches every affected application, container and installation workflow.

Research Evidence

• Vendor: Microsoft .NET.
• Security release: October 25, 2026, out-of-band update.
• Main CVEs: CVE-2026-111497 and CVE-2026-114148.
• Additional corrected advisories: CVE-2026-70197 and CVE-2026-102870.
• Brotli impact: Memory corruption with possible information disclosure, denial of service or privilege escalation.
• Tarball impact: Local elevation of privilege involving specified Linux distribution artifacts.
• Fixed .NET 8 runtime: 8.0.33.
• Fixed .NET 9 runtime: 9.0.22.
• Fixed .NET 10 runtime: 10.0.14.
• .NET 11 preview update: Release Candidate 3.
• Framework-dependent remediation: Update runtime and restart.
• Self-contained remediation: Rebuild and republish.
• Container remediation: Rebuild and redeploy using patched base images.
• Primary evidence: Microsoft .NET release announcement and official security advisories.

Frequently Asked Questions

Why did Microsoft release emergency .NET security updates?

Microsoft released out-of-band updates on October 25, 2026, to fix the Brotli decoder vulnerability, a Linux tarball privilege-escalation issue, and two incompletely addressed earlier vulnerabilities.

What is CVE-2026-111497?

It is a Brotli decompression memory-corruption vulnerability that can affect applications processing attacker-controlled compressed content through vulnerable .NET APIs.

What is CVE-2026-114148?

It is a Linux .NET tarball file-ownership vulnerability that can allow local privilege escalation under affected installation conditions.

Which .NET versions contain the fixes?

The updated releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3.

Does the Brotli vulnerability affect every ASP.NET Core application?

No. Exposure depends on whether the application processes untrusted Brotli-compressed data through an affected decompression path. Common request and response decompression features are not enabled by default.

Is .NET Framework affected?

Microsoft states that .NET Framework is not affected by the Brotli vulnerability addressed in this emergency .NET release.

Do Docker containers automatically receive the fix?

No. Container images must be rebuilt using patched runtime components, then redeployed. Existing containers continue using their bundled software until replaced.

How can administrators check installed .NET versions?

Run dotnet –list-runtimes and dotnet –list-sdks on relevant systems, then separately inspect self-contained applications, NativeAOT executables and container images.

Final Takeaway

Microsoft .NET security updates issued on October 25 address two important vulnerabilities involving Brotli decompression and Linux distribution-file ownership.

The same release also completes remediation for two earlier security issues.

Organizations should inventory their .NET applications, verify patched runtimes and rebuild any self-contained or containerized workloads that include vulnerable components.

Already patched Node.js for the Brotli flaw? That does not mean your .NET applications are protected. Each runtime needs its own security update.

Our related investigation explains the earlier Node.js patch release, including the same Brotli CVE and nine other vulnerabilities.

Read Next: Node.js Fixes 10 Security Flaws, Including Brotli Remote Code Execution →

Official Sources and Research

• Microsoft .NET Team — October 25 Out-of-Band Security Updates
• Microsoft Security Advisory — CVE-2026-111497 Brotli Decoder Vulnerability
• Microsoft Security Advisory — CVE-2026-114148 Linux .NET Tarball Ownership