Microsoft issued out-of-band updates on October 25 for .NET 8, 9, 10 and 11 RC3, addressing four vulnerabilities: two newly disclosed flaws and two issues the October 13 Patch Tuesday release had not fully fixed. .NET 11 RC2 users must move to RC3 for these fixes.
The new critical flaw (CVE-2026-111497) is in Brotli decompression: .NET can write past reserved memory while unpacking compressed data, exposing or corrupting neighboring process memory. Microsoft says an unauthenticated attacker could trigger information disclosure, denial of service or privilege elevation. The other new flaw (CVE-2026-114148) permits local privilege elevation on affected Linux tarballs; the reissued fixes address memory corruption (CVE-2026-70197) and code injection (CVE-2026-102870).
If .NET is bundled into self-contained apps or container images, a shared-runtime update does not replace those copies; exposure remains until the app or image is rebuilt and redeployed.
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overf
Microsoft’s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release