Microsoft issues out-of-band .NET patch fixing critical buffer overflow

On October 25, Microsoft issued out-of-band updates for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. The emergency release fixes two newly disclosed vulnerabilities and re-issues patches for two October 13 flaws that the regular rollout only partly fixed. Microsoft urges customers to apply the updates as soon as possible.

Microsoft re-issued fixes for CVE-2026-70197 and CVE-2026-102870 after the October 13, 2026, Patch Tuesday rollout only partly addressed them. CVE-2026-70197 rates as a memory corruption flaw across .NET 8, 9, 10, and 11. CVE-2026-102870 rates as a code injection issue affecting .NET 10 and 11.

The standout flaw is CVE-2026-111497, a critical buffer overflow in Brotli decompression reaching .NET 8, 9, 10, and 11 on every operating system, with a CVSS score of 9.2. An unauthenticated attacker can exploit it to read or corrupt memory in a running process, which might expose data, disrupt service, or allow privilege elevation.

Applications are exposed when they handle Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs. These features ship disabled by default, and the .NET Framework is not affected by the flaw. Brotli, a compression algorithm, dates to 2015, when two Google engineers designed it to speed up compression. Microsoft manages the free, open-source .NET framework, which runs on Windows, Linux, or macOS.

Microsoft says CVE-2026-114148 lets an authorized local attacker on Linux escalate privileges using the unsafe ownership metadata attached to .NET tarballs (archive packages). The .NET Blog lists versions 8, 9, 10, and 11 as affected on Linux, while Infosecurity Magazine reports versions 7 through 11. A CVE Numbering Authority has reserved the identifier, though no CVSS score exists yet.

For .NET 10 and .NET 11 on Linux, the problem affects only source-build tarballs. For .NET 8 and .NET 9, the issue also reaches ASP.NET Core distributions pulled from ASP.NET Core tarballs, even for users who never compile .NET from source.

Framework-dependent applications — programs that rely on a shared installed runtime — must install the updated runtime matching their targeted .NET version, then restart the application. Self-contained applications include their own runtime, so updating the host does not change what ships in the app; administrators must rebuild and republish with the updated runtime. Container deployments require a rebuild and redeployment using updated .NET container images.

Source-build consumers — people who build .NET from source — need updated source-build artifacts for their .NET version, and they must rebuild packages to include the tarball ownership fix. People using ASP.NET Core tarballs — archive packages of ASP.NET Core — on .NET 8 and 9 should switch to the updated ASP.NET Core Runtime tarball matching their version, even if they never compile .NET from source. Anyone on .NET 11 Release Candidate 2 should move up to Release Candidate 3.

The dotnet –list-runtimes command lets users verify installed runtimes, but self-contained applications and container deployments carry their own runtime, so they need separate checks. Anyone running Google Brotli versions 1.0.3 through 1.2.0 should refresh Brotli libraries or binaries to the latest release to address the flaw in Brotli decompression itself.

The October 13, 2026, Patch Tuesday update shipped security fixes covering more than 1,400 vulnerabilities, including three zero-days. Microsoft confirmed active exploitation of one, while the other two were publicly disclosed before patches were available. Amol Sarwate said, “Microsoft released a massive update today, patching more than 1,400 CVEs, driven in large part by AI models identifying vulnerabilities faster than humans can.”

Among the .NET-specific fixes from that rollout was CVE-2026-108398, a .NET Framework flaw with a CVSS score of 8.8. Low-level access could let an attacker bypass Windows Defender Application Control through CVE-2026-108398, using an untrusted assembly search path that loads unauthorized .NET code in a protected process. Microsoft has not confirmed that attackers are actively exploiting CVE-2026-108398, even though details of the flaw were already public.

Administrators should put the actively exploited Windows Shell vulnerability first on Windows endpoints and servers. The Outlook remote code execution flaws CVE-2026-70242 and CVE-2026-97016 score 9.8 on CVSS, and attackers can exploit them through the Reading Pane without any user interaction. Microsoft QUIC flaw CVE-2026-105016 involves a heap-based buffer overflow and rates as a critical remote code execution bug scoring 9.8 on CVSS. Microsoft has not reported active exploitation and considers exploitation less likely.