.NET October 2026 Out-of-Band Security Updates
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Microsoft released out-of-band security updates for .NET 8 (8.0.33), .NET 9 (9.0.22) and .NET 10 (10.0.14), plus .NET 11 RC3. They fix a Brotli decompression buffer overflow (CVE-2026-111497) that could expose or corrupt memory, and unsafe ownership metadata in Linux tarballs (CVE-2026-114148). Two earlier fixes from the October 13 release were incomplete and are re-issued. Self-contained apps and containers must be rebuilt. Microsoft's own advisory is the only source here, and the claims were not independently verified.