CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 (.NET Blog, 2026-10-25). The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected (.NET Blog, 2026-10-25). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege (.NET Blog, 2026-10-25); Microsoft scores it CVSS 3.1 8.1 with high attack complexity, marks it publicly disclosed and not exploited, and rates it Exploitation More Likely (MSRC, 2026-10-25). The CVE is the one Node.js fixed on 2026-10-21 (Node.js project, 2026-10-21). Microsoft says an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default (dotnet/announcements #494, 2026-10-25).

The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 (.NET Blog, 2026-10-25). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) (dotnet/runtime #136445, 2026-10-25); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely, and had said on 2026-10-19 that the vulnerability had not been addressed (MSRC, 2026-10-25). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute (dotnet/announcements #492, 2026-10-25). CVE-2026-114148 is incorrect file ownership in Linux ASP.NET Core runtime and targeting-pack tarballs of .NET 8 and 9 and in source-built tarballs, a local privilege escalation (CVSS 3.1 7.8) (dotnet/announcements #495, 2026-10-25). No source reports exploitation of any of the four.