---
schema: 1
kind: vulnerability
title: "CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)"
headline: "Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw"
summary: >
  Microsoft released .NET 8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3 out of band on 2026-10-25 to fix the Brotli decoder flaw
  CVE-2026-111497 (CVSS 3.1 8.1, publicly disclosed, not exploited, rated Exploitation More Likely) and to deliver the corrected fixes for
  CVE-2026-70197 (Windows sockets memory corruption, CVSS 3.1 8.1) and CVE-2026-102870 (Blazor debugger), which the 2026-10-13 release did
  not fully address. Brotli exposure needs an application that decompresses attacker-controlled Brotli data, which ASP.NET Core and
  HttpClient do not do by default.
discovered_at: "2026-10-26T03:36:00Z"
updated_at: null
event_date: "2026-10-25"
run_id: 2026-10-26T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [technology]
entities: ["product:microsoft-net", "product:microsoft-asp-net-core", "product:microsoft-visual-studio", "product:google-brotli"]
techniques: [T1190, T1203, T1068]
affected_products: ["Microsoft .NET", "Microsoft ASP.NET Core", "Microsoft Visual Studio"]
cves:
  - id: CVE-2026-111497
    cvss: "8.1 (CVSS 3.1)"
    epss: null
    type: memory-corruption
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: ".NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14 and .NET 11 before Release Candidate 3 (runtime and NativeAOT packages); .NET Framework is not affected"
    fixed: "8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3"
  - id: CVE-2026-70197
    cvss: "8.1 (CVSS 3.1)"
    epss: null
    type: memory-corruption
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Windows runtime packages of .NET 8 before 8.0.33, .NET 9 before 9.0.22, .NET 10 before 10.0.14 and .NET 11 before Release Candidate 3; the 2026-10-13 release did not contain the fix"
    fixed: "8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3"
  - id: CVE-2026-102870
    cvss: "8.8 (CVSS 3.1)"
    epss: null
    type: rce
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer 10.0.0 before 10.0.14 and 11.0.0-preview.1 before 11.0.0-rc.3"
    fixed: "10.0.14, 11.0.0-rc.3"
  - id: CVE-2026-114148
    cvss: "7.8 (CVSS 3.1)"
    epss: null
    type: priv-esc
    vector: local
    auth: post-auth
    status: [patch-available]
    affected: "ASP.NET Core runtime and targeting-pack Linux tarballs of .NET 8 before 8.0.33 and .NET 9 before 9.0.22; source-built .NET tarballs"
    fixed: "8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3"
sources:
  - url: "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/"
    publisher: ".NET Blog (Microsoft)"
    date: "2026-10-25"
    role: primary
  - url: "https://github.com/dotnet/announcements/issues/494"
    publisher: "Microsoft (dotnet/announcements, CVE-2026-111497 advisory)"
    date: "2026-10-25"
    role: primary
  - url: "https://github.com/dotnet/runtime/issues/136445"
    publisher: "Microsoft (dotnet/runtime, CVE-2026-70197 advisory)"
    date: "2026-10-25"
    role: primary
  - url: "https://github.com/dotnet/announcements/issues/492"
    publisher: "Microsoft (dotnet/announcements, CVE-2026-102870 advisory)"
    date: "2026-10-25"
    role: primary
  - url: "https://github.com/dotnet/announcements/issues/495"
    publisher: "Microsoft (dotnet/announcements, CVE-2026-114148 advisory)"
    date: "2026-10-25"
    role: primary
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497"
    publisher: "Microsoft Security Response Center (CVE-2026-111497)"
    date: "2026-10-25"
    role: corroborating
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197"
    publisher: "Microsoft Security Response Center (CVE-2026-70197)"
    date: "2026-10-25"
    role: corroborating
  - url: "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
    publisher: "Node.js project"
    date: "2026-10-21"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3."
    publisher: ".NET Blog (Microsoft)"
    source_url: "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/"
  - quote: "because the October 13, 2026 release did not fully address these issues"
    publisher: ".NET Blog (Microsoft)"
    source_url: "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/"
  - quote: "ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations."
    publisher: "Microsoft (dotnet/announcements, CVE-2026-111497 advisory)"
    source_url: "https://github.com/dotnet/announcements/issues/494"
verification: single-source
sourcing_note: >
  Microsoft is the disclosing party for its own product, and its blog, the four dotnet advisories and the Security Update Guide agree on
  versions and CVE ids; they are one assessor. The Brotli flaw is the same CVE that Node.js fixed on 2026-10-21, and Microsoft's own
  pages are the basis for every .NET statement here.
confidence: high
references: ["2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi"]
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime."
updates: []
migrated_from: null
---

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)); Microsoft scores it CVSS 3.1 8.1 with high attack complexity, marks it publicly disclosed and not exploited, and rates it Exploitation More Likely ([MSRC, 2026-10-25](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497)). The CVE is the one Node.js fixed on 2026-10-21 ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). Microsoft says an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default ([dotnet/announcements #494, 2026-10-25](https://github.com/dotnet/announcements/issues/494)).

The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) ([dotnet/runtime #136445, 2026-10-25](https://github.com/dotnet/runtime/issues/136445)); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely, and had said on 2026-10-19 that the vulnerability had not been addressed ([MSRC, 2026-10-25](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197)). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute ([dotnet/announcements #492, 2026-10-25](https://github.com/dotnet/announcements/issues/492)). CVE-2026-114148 is incorrect file ownership in Linux ASP.NET Core runtime and targeting-pack tarballs of .NET 8 and 9 and in source-built tarballs, a local privilege escalation (CVSS 3.1 7.8) ([dotnet/announcements #495, 2026-10-25](https://github.com/dotnet/announcements/issues/495)). No source reports exploitation of any of the four.

**Exposure:** a framework-dependent host shows its runtime with `dotnet --list-runtimes`, which must list 8.0.33, 9.0.22 or 10.0.14; self-contained applications and container images carry their own runtime and must be checked per artifact ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). The Brotli path is any code that enables request or response Brotli decompression or calls the Brotli APIs on untrusted data; CVE-2026-70197 needs Windows code that reuses one SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets ([dotnet/announcements #494, 2026-10-25](https://github.com/dotnet/announcements/issues/494); [dotnet/runtime #136445, 2026-10-25](https://github.com/dotnet/runtime/issues/136445)).

**Detection:** no source describes an exploitation indicator. The telemetry that would show an attempt on the Brotli path is web access logs with a Brotli request content encoding on endpoints that decompress request bodies, followed by crashes of the hosting process.

**Defender takeaway:** install the updated runtime on every .NET host now, including Windows hosts patched on 2026-10-13, which still carry CVE-2026-70197 ([.NET Blog, 2026-10-25](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)). SDKs installed through Visual Studio update when Visual Studio itself is updated ([dotnet/runtime #136445, 2026-10-25](https://github.com/dotnet/runtime/issues/136445)). Where an update has to wait, Microsoft advises avoiding decompression of attacker-controlled Brotli data: remove the br entry from an existing request decompression configuration or Brotli from an existing automatic decompression setting, and do not add decompression where an application does not already use it ([dotnet/announcements #494, 2026-10-25](https://github.com/dotnet/announcements/issues/494)).