{
  "id": 18030970,
  "title": "GHSA-P3JP-9V83-76W9: CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder",
  "url": "https://urgent.news/2026/11/03/ghsa-p3jp-9v83-76w9-cve-2026-111497-ghsa-p3jp-9v83-76w9-out-of-bounds",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T22:30:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/ghsa-p3jp-9v83-76w9-cve-2026-111497-ghsa-p3jp-9v83-76w9-out-of-bounds-heap-write-in-microsoft-40b4"
  },
  "original_language": "en",
  "account": "CVE-2026-111497, also identified as GHSA-p3jp-9v83-76w9, represents an out-of-bounds heap write vulnerability in the Microsoft .NET Brotli decoder. This flaw allows unauthenticated attackers to corrupt memory via specially crafted Brotli compressed data, leading to denial of service, information disclosure, or potentially arbitrary code execution. The vulnerability stems from the fast execution path of the .NET runtime's Brotli decoder, which skips validation of block-switch sequences, leaving the process open to memory corruption. Patched versions of the .NET runtime address this issue, including .NET 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3. Applications utilizing the Brotli decompression feature must be updated to these versions to mitigate the risk.",
  "summary": "CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder Vulnerability ID: GHSA-P3JP-9V83-76W9 CVSS Score: 8.1 Published: 2026-11-03 CVE-2026-111497 (tracked as GHSA-p3jp-9v83-76w9) is an out-of-bounds heap write vulnerability in the native Google Brotli decompression library bundled within the Microsoft .NET runtime. The flaw occurs during the parsing of…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}