# Microsoft patches high-risk Brotli flaw affecting .NET and other software

- URL: https://talkfuse.com/story/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/
- Published: 2026-10-26T17:58:00+00:00
- Updated: 2026-10-26T18:14:09+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515
- Topics: Software, Technology

## Key points

- Microsoft urges .NET users to install emergency Brotli security fixes.
- The flaw could expose or corrupt process memory.
- Multiple software projects and cloud environments are affected.

## Summary

Microsoft has issued emergency security updates for .NET after a flaw in Google’s Brotli compression technology was found to pose risks across many software projects. The buffer overflow could let an unauthenticated attacker read or corrupt process memory, potentially causing data disclosure, service disruption or elevated privileges.

The vulnerability, CVE-2026-111497, has a CVSS v3.1 score of 8.1, and Microsoft says exploitation is considered more likely, although successful attacks have not been reported. Updates are available for .NET 8, 9, 10 and 11; Node.js, Python, Bun, Envoy and Istio have also issued patches. Researchers say affected routes include specially crafted web requests and JPEG XL images processed by FFmpeg, while Wiz estimates 91% of cloud environments use vulnerable components.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.