MicrosoftAnalysisMicrosoft patches critical Brotli buffer overflow in .NET
What happened.Microsoft issued emergency out-of-band updates across supported .NET versions to address a critical buffer overflow vulnerability in the bundled Google Brotli compression decoder.
Why it matters.Modern web microservices depend on automated content encoding to compress outbound traffic and reduce transport costs. When decompression libraries fail during streaming parsing, unauthenticated network traffic can compromise core web application runtimes before perimeter authorization rules execute. Engineering teams must deploy runtime updates immediately and audit edge proxies for malformed Brotli payloads.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111497 with a 9.2 CVSS score, an out-of-bounds write flaw in decode.c mishandles invalid block switches, causing streaming decoders to overflow process memory.
- Exploitation path: Remote unauthenticated actors deliver crafted compressed HTTP payloads to corrupt application state, leak sensitive memory elements, or execute unauthorized code on hosting nodes.
- Remediation releases: Microsoft published security updates for .NET versions 8, 9, 10, and 11, advising administrators to apply runtime patches and update ASP.NET Core request decompression pipelines.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: