Microsoft ships emergency .NET fixes for a critical Brotli flaw
Many programs copy the vulnerable Brotli decoder into their own code, so each needs its own fix. Wiz says 91% of cloud environments contain vulnerable resources. Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too. In a .NET blog post, Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its security update guide lists the Visual Studio and PowerShell builds. Microsoft rates the flaw critical for .NET and Visual…













.png)
































