Microsoft shipped .NET updates out of band on Saturday (Oct 25) for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with .NET. The .NET advisory scores it 8.1 and MSRC rates it Critical for .NET, and Microsoft says exploitation is more likely, with no exploitation reported as of the 25th.
The patched runtimes are 8.0.33, 9.0.22 and 10.0.14. Anything below those is still exposed, and .NET Framework is not affected, so older Framework servers can sit this one out. The same release also fixes CVE-2026-114148, a file-ownership problem in .NET tarballs on Linux, and it re-does two October 13 fixes that had not fully landed (CVE-2026-70197 and CVE-2026-102870).
A few things that decide how urgent this is on a given box:
Exposure needs an app that decompresses Brotli data it does not control, through ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs. Neither decompression path is on by default, so a patched-later queue is defensible for internal apps that never enable them, while internet-facing ASP.NET Core goes first.
Updating the shared runtime does nothing for self-contained apps because they carry their own copy of the runtime, and those need a rebuild and redeploy. Framework-dependent apps pick the fix up from the runtime update, though the processes still need a restart, and on IIS that means updating the ASP.NET Core Hosting Bundle rather than only the runtime.
PowerShell is in scope as well, with fixes in 7.4.22, 7.5.13 and 7.6.9, which matters on admin workstations that never run a .NET app. Anyone on Azure App Service with built-in .NET images on Linux gets the platform update from Microsoft; the rollout had finished for the Latest channel and was still going out to Standard as of Oct 26.
\dotnet --list-runtimes\ gives a quick inventory per machine. Microsoft's announcement is here: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.
Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.
Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.
Microsoft PowerShell Remote Code Execution Vulnerability
Microsoft PowerShell Remote Code Execution Vulnerability
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
PowerShell Information Disclosure Vulnerability
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-40400.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-40400.
Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
.NET - SecurityFeatureBypass - Denial of Service and Security Feature Bypass via Unsafe Transforms in EncryptedXml
End of life: 11/14/2028, Latest version: 7.6.9
Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
.NET and Visual Studio Remote Code Execution Vulnerability
End of life: 11/10/2026, Latest version: 7.5.13
.NET Remote Code Execution Vulnerability
End of life: 11/10/2026, Latest version: 7.4.22
End of life: 11/10/2026, Latest version: 7.4.22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell Reference for Office Products. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell Reference for Office Products. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
.NET and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Microsoft QUIC Denial of Service Vulnerability