微软紧急发布.NET Brotli漏洞补丁
微软为 .NET、Visual Studio 和 PowerShell 发布临时更新，修复由 OpenAI Codex Security 团队报告的 Google Brotli 压缩库缓冲区溢出漏洞 CVE-2026-111497。.NET 8、9、10 和 11 RC3 均在修复范围内，Node.js、PHP、Python 套件及其他内置 Brotli 的项目也已发布补丁。研究人员对该漏洞的实际影响存在分歧，尚未确认公开可用的完整攻击或真实攻击事件。
该漏洞波及多个常用软件生态；受影响应用不仅需要更新运行环境，还须重建内置 Brotli 副本的版本，因为运行中的进程仍可能使用旧代码。
Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too.
In a .NET blog post, Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its security update guide lists the Visual Studio and PowerShell builds.
#Microsoft#Brotli#Google#OpenAI Codex Security#Node.js#PHP#Visual Studio#PowerShell#Python