Microsoft patches high-risk Brotli flaw affecting .NET and other software
Microsoft has issued emergency security updates for .NET after a flaw in Google’s Brotli compression technology was found to pose risks across many software projects. The buffer overflow could let an unauthenticated attacker read or corrupt process memory, potentially causing data disclosure, service disruption or elevated privileges.
The vulnerability, CVE-2026-111497, has a CVSS v3.1 score of 8.1, and Microsoft says exploitation is considered more likely, although successful attacks have not been reported. Updates are available for .NET 8, 9, 10 and 11; Node.js, Python, Bun, Envoy and Istio have also issued patches. Researchers say affected routes include specially crafted web requests and JPEG XL images processed by FFmpeg, while Wiz estimates 91% of cloud environments use vulnerable components.
In short
- Microsoft urges .NET users to install emergency Brotli security fixes.
- The flaw could expose or corrupt process memory.
- Multiple software projects and cloud environments are affected.
Explained simply
Brotli is a data-compression technology created by Google that helps software send and store information more efficiently. It is used in many programming tools and services, including Microsoft’s .NET platform and software built with Node.js and Python.
The flaw is a memory-handling error: under certain conditions, specially formed input could make affected software expose or damage information in its working memory. That could disrupt a service or affect data, depending on how the software is used.
The issue matters because Brotli components are present across a wide range of software, including systems used in cloud environments. Microsoft and other project teams maintain the affected products, while developers and organisations that use them are responsible for applying relevant fixes.
Read the full article at the source →
Originally published by The Register as “Microsoft releases emergency .NET security fixes for Google Brotli bug”.