# Microsoft issues emergency .NET fixes for Brotli decoding flaw

_Published Monday, October 26, 2026 at 1:17 PM EDT · Security · Latest · Tier 2 — Notable_

![Microsoft issues emergency .NET fixes for Brotli decoding flaw — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/26/Microsoft-NET.jpg)

Microsoft released emergency security updates for a critical Brotli decoding vulnerability affecting .NET, BleepingComputer reported. The flaw, CVE-2026-111497, allows crafted compressed data to trigger crashes or memory leaks and, in some cases, remote code execution.

Updates cover .NET 8, .NET 9 and .NET 10, plus .NET 11 Release Candidate 3. Exposure requires applications to opt into Brotli request or response decompression or invoke the decoding APIs; Brotli decompression is disabled by default.

Proof-of-concept exploits are public, but no malicious exploitation has been reported. Updating a system's Brotli library does not fix applications that bundle their own copy.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/)

---
Canonical: https://techandbusiness.org/newswire/ikGfPcXl4oZ9R1v6QBIwA-
Published: 2026-10-26T17:17:08.417Z
Story chronology: 2026-10-26T15:38:24.000Z
Retrieved: 2026-10-26T20:02:32.980Z
Publisher: Tech & Business (techandbusiness.org)