Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft released out-of-band security updates for .NET 8, 9, 10, and 11 to patch CVE-2026-111497, a buffer overflow vulnerability in Google's Brotli compression technology rated 8.1 under CVSS v3.1. The flaw could enable unauthorized read/corruption of process memory, potentially leading to information disclosure, denial of service, or privilege escalation. While working exploits have been created, there is no evidence of active criminal exploitation, though Microsoft's assessment suggests exploitation is likely. The vulnerability was initially disclosed by the Node.js team on October 21.

Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.