Microsoft releases emergency .NET security fixes for Google Brotli bug
Redmond joins growing list of software maintainers scrambling to patch compression flaw
Microsoft has released an emergency security patch for .NET after discovering a vulnerability in Google's Brotli compression technology. This security flaw, labeled CVE-2026-111497, could enable attackers to corrupt memory or even elevate privileges on affected systems. The issue, which originated in Brotli's source code in February, went unnoticed until October 21 when the Node.js team disclosed it as CVE-2026-111497, along with nine other vulnerabilities.
Microsoft classified this vulnerability as potentially exploitable and urged .NET users to update their systems as soon as possible. The buffer overflow issue affects various software applications that use Brotli, including .NET, Node.js, Python, Bun, Envoy, Istio, and FFmpeg. Experts recommend blocking untrusted Brotli-compressed data and restarting services to ensure the security patch is applied.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
