CVE-2026-114148

Same Brotli bug, now in Microsoft .NET

On Oct 25 Microsoft released out-of-band updates for .NET 8, 9, 10 and .NET 11 Release Candidate 3 for CVE-2026-111497. The Brotli decoder can overflow a buffer when it unpacks a crafted compressed stream, which can leak memory, crash the process, or raise privileges. Microsoft rates it High at CVSS 8.1.

Default https://t.co/rr7RfnD7he Core and HttpClient setups do not unpack Brotli automatically. Apps are exposed when they turn on Brotli request or response decompression, or call BrotliStream / BrotliDecoder on untrusted data. .NET Framework is not affected. Microsoft says it is not known to be exploited.

The same release also fixes CVE-2026-114148, a Linux tarball ownership flaw that can let a local account raise privileges. Update to runtime 8.0.33, 9.0.22 or 10.0.14 (and .NET 11 RC3). Rebuild self-contained apps and containers.

Sources: .NET October 2026 OOB updates: https://t.co/nQm1J6lQWn Microsoft Security Advisory CVE-2026-111497: https://t.co/Nv1NwQydK5 Microsoft Security Advisory CVE-2026-114148: https://t.co/LY7pRNElTm MSRC CVE-2026-111497: https://t.co/r8RtrqgZpd