Microsoft Ships Emergency .NET Fixes for Brotli Vulnerability
Microsoft released out-of-band updates for .NET, Visual Studio and PowerShell to address CVE-2026-111497, a buffer overflow in Google’s Brotli compression library reported by OpenAI’s Codex Security team. The .NET fixes cover versions 8, 9, 10 and 11 Release Candidate 3, while Node.js, PHP, Python packages and other projects that bundle Brotli have also shipped patches. Researchers disagree on the flaw’s practical impact, and no released working exploit or reported attack has been confirmed.
The Brotli issue reaches widely used software ecosystems, and affected applications must update their runtimes or rebuild bundled copies because running processes can retain vulnerable code.
Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too.
In a .NET blog post, Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its security update guide lists the Visual Studio and PowerShell builds.
#Microsoft#Brotli#Google#OpenAI Codex Security#Node.js#PHP#Visual Studio#PowerShell#Python