Microsoft has released out-of-bound (OOB) security updates for its .NET developer platform, which includes a fix for a critical buffer overflow vulnerability.

The tech giant published the updates for .NET versions 8, 9, 10, and 11 Release Candidate 3 on October 25. Platform users have been urged to apply the updates as soon as possible to reduce the risk of compromise.

They contain patches for two newly disclosed vulnerabilities, as well as two flaws that were not fully addressed in Microsoft’s October Patch Tuesday rollout.

Single updates are available for each of the affected .NET versions and .NET 11 RC2 users should update to RC3 to receive these fixes.

.NET is a free, open-source framework that developers can use to build apps and cloud services. It is managed by Microsoft and is supported on Windows, Linux and macOS operating systems.

Updates Address Critical Buffer Overflow Vulnerability

One of the new vulnerabilities addressed is CVE-2026-111497, which affects .NET versions 8, 9, 10, and 11 across all operating systems.

The vulnerability is contained in the Brotli decompression algorithm, which is used by .NET. It can allow an unauthenticated attacker to read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege.

Microsoft said that applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs.

The flaw has a critical CVSS Score of 9.2. Users of Google Brotli versions 1.0.3 through 1.2.0 also need to update any Brotli libraries or binaries to the latest available version.

Brotli was designed by two engineers at Google in 2015 to allow developers to speed up algorithm compression for developers.

Microsoft’s OOB update also addresses CVE-2026-114148, which can allow an authorized attacker to elevate privileges locally by exploiting unsafe ownership metadata in affected .NET tarballs.

CVE-2026-114148 affects .NET versions 7-11, but only for Linux systems. For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source, the advisory noted.

It has not been assigned a CVSS score at the time of writing but has been reserved by a CVE Numbering Authority (CNA).

In addition, Microsoft has re-issued fixes for two vulnerabilities disclosed in its October 13 Patch Tuesday rollout. These are for CVE-2026-70197, a memory corruption flaw affecting .NET versions 8-11, and CVE-2026-102870, a code injection vulnerability affecting .NET 10 and 11.

Remediation Guidance for Developers

Microsoft issued advice for .NET users on how to update their applications and build environments in light of the updates. These include:

• Install the updated runtime for the .NET version for your framework-dependent application, then restart the application
• Rebuild and republish self-contained applications with the updated runtime
• Rebuild and redeploy containers using updated .NET container images
• Obtain the updated source-build artifacts for your .NET version and rebuild your packages to incorporate the tarball ownership fix
• For ASP.NET Core tarball users on .NET 8 and 9, update your installation using the refreshed ASP.NET Core Runtime tarball for your .NET version

Image credit: II.studio / Shutterstock.com