.NET October 2026 Out-of-Band Security Updates
Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.
Security updates
This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm. It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.
CVE Description Affected platforms
CVE-2026-111497 A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.