{
  "id": 16637876,
  "title": "Microsoft releases emergency .NET security fixes for Google Brotli bug",
  "url": "https://urgent.news/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-26T17:58:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515"
  },
  "original_language": "en",
  "account": "Microsoft has released an emergency security patch for .NET after discovering a vulnerability in Google's Brotli compression technology. This security flaw, labeled CVE-2026-111497, could enable attackers to corrupt memory or even elevate privileges on affected systems. The issue, which originated in Brotli's source code in February, went unnoticed until October 21 when the Node.js team disclosed it as CVE-2026-111497, along with nine other vulnerabilities. Microsoft classified this vulnerability as potentially exploitable and urged .NET users to update their systems as soon as possible. The buffer overflow issue affects various software applications that use Brotli, including .NET, Node.js, Python, Bun, Envoy, Istio, and FFmpeg. Experts recommend blocking untrusted Brotli-compressed data and restarting services to ensure the security patch is applied.",
  "summary": "Redmond joins growing list of software maintainers scrambling to patch compression flaw",
  "key_points": [
    "Microsoft releases emergency .NET security patch",
    "CVE-2026-111497 vulnerability in Google Brotli",
    "Urged updates to prevent memory corruption and privilege escalation"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}