Microsoft has shipped an unscheduled round of security updates for .NET, covering versions 8, 9 and 10 plus a refreshed .NET 11 Release Candidate 3. The out-of-band release closes a maximum-severity buffer overflow in Brotli decompression, seals a Linux packaging hole that can hand local attackers higher privileges, and replaces two earlier fixes Microsoft now says were incomplete. Developers are being urged to install the new builds without delay.
- Key Point: The October 25, 2026 release moves .NET 8 to 8.0.33, .NET 9 to 9.0.22, .NET 10 to 10.0.14 and .NET 11 to RC3.
- Key Point: CVE-2026-111497 is an out-of-bounds write in .NET’s Brotli decoder that unauthenticated attackers can use to tamper with process memory on any platform.
- Key Point: CVE-2026-114148 covers unsafe ownership metadata in Linux tarballs, allowing a local user to modify files and escalate privileges.
- Key Point: Fixes for CVE-2026-70197 and CVE-2026-102870 are being reissued because the October 13, 2026 servicing release left them unresolved.
The Brotli decoder flaw tops the severity scale
CVE-2026-111497 carries a CVSS rating of 10, the ceiling of the scale, and applies to every platform .NET runs on. Microsoft’s advisory describes an out-of-bounds write in the runtime’s handling of Brotli decompression, with an unauthenticated attacker able to leak or overwrite the contents of process memory — enough to expose data, take a service down or climb toward higher privileges.
We recommend updating as soon as possible.
The vulnerable code is reachable only by applications that actually consume Brotli-compressed content, whether through ASP.NET Core request decompression, HttpClient’s automatic response decompression, or the Brotli APIs in System.IO.Compression. Neither decompression feature is switched on by default and .NET Framework is unaffected, so the practical risk lands on services that fetch or accept compressed input from sources they do not control.
The defect is not unique to .NET: it sits in the shared Brotli reference implementation, and Node.js shipped its own corrections on October 21, 2026. The upstream advisory covers releases 1.0.3 through 1.2.0, with fixes in 1.0.10, 1.1.1 and 1.2.1.
Two incomplete fixes get a second attempt
Two of the vulnerabilities in this release are repeats. CVE-2026-70197, an out-of-bounds write in System.Net.Sockets.Socket.ReceiveFromAsync rated Important at CVSS 8.1, resurfaces in .NET 8, 9, 10 and 11. The trigger is a single SocketAsyncEventArgs object reused for datagram sockets on both IPv4 and IPv6: the buffer caching the native address may remain sized for the smaller family, so a switch between the two writes past its end.
CVE-2026-102870 affects the Blazor WebAssembly debugger in .NET 10 and 11. Its debug proxy compiles C# on the fly to evaluate developer expressions, and some attacker-controlled values were not consistently escaped; an exploit needs an app under debug to expose such a value while a developer evaluates an expression, after which code executes on that machine. The rating is CVSS 8.8 and user interaction is required, and the affected set runs from Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 to 10.0.12 and into .NET 11 previews, plus Visual Studio 2022 before 17.14.42 and Visual Studio 2026 before 18.10.4.
The third new item, CVE-2026-114148, concerns unsafe ownership metadata in Linux .NET tarballs, which lets a local attacker alter files and gain elevated privileges. On .NET 10 and 11 only source-build tarballs are involved; on .NET 8 and 9 the exposure extends to ASP.NET Core distributions shipped as tarballs, so teams that never build the runtime from source are still in range. Ordinary Microsoft-published runtime and SDK tarballs, and standalone NuGet packages, are not.
Version targets and the upgrade path
The builds to install are 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3; RC2 users must move to RC3 to receive the fixes.
How the patch lands depends on deployment shape. Framework-dependent apps need the updated runtime plus a restart; self-contained apps must be rebuilt and republished, since a newer runtime on the host leaves the bundled copy untouched. Containers need refreshed images, source-build consumers need updated artifacts, and teams on .NET 8 or 9 who installed ASP.NET Core from a tarball must refresh that install even without compiling .NET themselves. Running dotnet –list-runtimes shows what is actually present.
On Windows, the .NET 9 build arrives through Microsoft Update for clients and WSUS or the Microsoft Update Catalog for servers. Standalone installers add the new version before removing the old one — 9.0.22 replaces 9.0.21 — although administrators can defer or disable that cleanup. A restart may be needed if affected files are in use.
Timing sharpens the stakes. .NET 8 and .NET 9 both leave support on November 10, 2026, as .NET 11 approaches general availability, so neither branch will receive further security servicing. Teams still running either one should treat these builds as a bridge, not a destination.