.NET 11 RC3, .NET 10.0.14 GA, .NET 9.0.22, and .NET 8.0.33 Oct. 25, 2026 out-of-band updates

Microsoft Dev Blogs:

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.

Security updates

This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm. It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.

CVE	Description	Affected platforms
CVE-2026-111497	A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege.	All Platforms
CVE-2026-114148	Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges.	Linux

Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source.

For vulnerability details and affected products, see the linked security advisories.

Additionally, we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October 13, 2026 release did not fully address these issues. Today’s updates provide those fixes.

Download the updates

.NET version	Update	Download
.NET 8	8.0.33	.NET 8 SDK and Runtime
.NET 9	9.0.22	.NET 9 SDK and Runtime
.NET 10	10.0.14	.NET 10 SDK and Runtime
.NET 11	Release Candidate 3	.NET 11 SDK and Runtime

.NET 11 RC2 users should update to RC3 to receive these fixes.

https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

Releases · dotnet/core

.NET news, announcements, release notes, and more! - dotnet/core

github.com

Click to expand...

tecknot

living in a van down by the river

Power User

Today at 4:00 AM

Hi Shawn,

Is there going to be a WU released or are we to update these .Nets manually?

Please advise.

Kind regards,

tecknot

My Computers

System One Other systems

At a glance
Windows 11 Pro 25H2 build 26200.9457Intel i7 8750H @ 2.2 GHz16 GB (all Samsung) DDR4-3200 SODIMM (non-ECC...Intel UHD Graphics 630 & NVIDIA Quadro P600

OS
Windows 11 Pro 25H2 build 26200.9457
Computer type
Laptop
Manufacturer/Model
Lenovo ThinkPad Workstation P72
CPU
Intel i7 8750H @ 2.2 GHz
Motherboard
Lenovo 01YU291
Memory
16 GB (all Samsung) DDR4-3200 SODIMM (non-ECC) PCIe 3
Graphics Card(s)
Intel UHD Graphics 630 & NVIDIA Quadro P600
Sound Card
Realtek ALC3286 & Focusrite Saffire 24 Pro DSP
Monitor(s) Displays
17.3"
Screen Resolution
3840x2160
Hard Drives
1TB SSD Samsung 860 EVO SATA 3
1TB SSD Samsung 970 EVO M.2 NVMe PCIe 3 x 4
2TB SSD Samsung 990 PRO M.2 NVMe PCIe 3 x 4
PSU
230W
Cooling
fan
Keyboard
UltraNav
Mouse
Kensington wireless Orbit
Internet Speed
640Mbps
Browser
DuckDuckGo and Firefox
Antivirus
Defender
Other Info
CM246 Chipset
VM with Windows 11 26H2 b 26300.9711: 4 GB (all Samsung) DDR4-3200 SODIMM (non-ECC) PCIe 3; 150GB on SSD Samsung 990 PRO M.2 NVMe PCIe 3 x 4