Microsoft has released emergency updates for its .NET developer platform to address two newly disclosed vulnerabilities, including a critical buffer overflow flaw.
The vulnerability or weakness
The critical buffer overflow vulnerability, CVE-2026-111497, affects .NET versions 8, 9, 10, and 11, impacting Brotli decompression algorithms and allowing unauthenticated attackers to read or corrupt process memory.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-111497 | 9.2 | CRITICAL | No | - |
| CVE-2026-114148 | n/a | not scored | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages (2026-10-26)
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances (2026-10-23)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (2026-10-20)
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk (2026-10-20)
Business impact
Organizations using .NET could face significant business impact, including information disclosure, denial of service, or privilege escalation, if they do not apply the updates promptly.
Industries affected
All industries using .NET for app and cloud service development are affected, including tech, finance, healthcare, and retail.
Users affected
Developers and system administrators must update their .NET applications and environments to mitigate the risk of compromise, ensuring they are not vulnerable to unauthorized access or data breaches.
Build these skills
Sources
- Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw (Infosecurity Magazine)
