Microsoft Dev Blogs:
Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.
Security updates
This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm. It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.CVE | Description | Affected platforms |
|---|---|---|
| CVE-2026-111497 | A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. | All Platforms |
| CVE-2026-114148 | Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges. | Linux |
Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.
For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source.
For vulnerability details and affected products, see the linked security advisories.
Additionally, we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October 13, 2026 release did not fully address these issues. Today’s updates provide those fixes.
Download the updates
.NET version | Update | Download |
|---|---|---|
| .NET 8 | 8.0.33 | .NET 8 SDK and Runtime |
| .NET 9 | 9.0.22 | .NET 9 SDK and Runtime |
| .NET 10 | 10.0.14 | .NET 10 SDK and Runtime |
| .NET 11 | Release Candidate 3 | .NET 11 SDK and Runtime |
.NET 11 RC2 users should update to RC3 to receive these fixes.
Read more:
