FHN 
Microsoft has published another round of .NET fixes after finding security problems in compressed-data processing and certain Linux software archives. The October 25, 2026, release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3.
These updates are particularly important for organizations that installed Microsoft’s October 13 patches. The latest release completes remediation for two issues that were not fully fixed in the earlier update.
What Are the Security Issues?
One vulnerability, CVE-2026-111497, affects Brotli decompression, which applications use to process compressed content. A buffer overflow could allow an unauthenticated attacker to access or corrupt memory. Depending on the application, this could lead to crashes, information exposure, or other security consequences.
The risk is relevant to applications that use Brotli through features such as ASP.NET Core request decompression, automatic decompression in HttpClient, or the System.IO.Compression APIs.
Microsoft says these decompression features are not enabled by default in the relevant configurations. The older .NET Framework is not affected.
The other issue, CVE-2026-114148, involves file ownership information in certain Linux .NET tarball packages. If exploited by a local attacker, the flaw could allow unauthorized file changes and potentially lead to higher privileges.
The affected packages depend on the .NET version:
- .NET 10 and .NET 11: source-build tarballs.
- .NET 8 and .NET 9: source-build tarballs and certain ASP.NET Core tarball installations.
The release also completes fixes for CVE-2026-70197, a memory corruption issue involving SocketAsyncEventArgs, and CVE-2026-102870, which concerns the Blazor WebAssembly debugger.
Which Versions Should Users Install?
Microsoft lists the following corrected releases:
- .NET 8.0.33
- .NET 9.0.22
- .NET 10.0.14
- .NET 11 Release Candidate 3
Administrators should determine how their applications are deployed before updating. Applications that use a shared runtime generally need the updated runtime and a restart. Self-contained applications bundle their own runtime, so they must be rebuilt and republished. Containerized workloads should be rebuilt and redeployed using updated base images.
For Linux source-build environments, teams should obtain the refreshed archives and rebuild affected packages. The command dotnet --list-runtimes can help check installed shared runtimes, but it will not identify every bundled runtime inside applications or containers.
Organizations should prioritize systems that process compressed input, verify whether affected Linux archives are used, and confirm that the corrected versions are deployed throughout their environments.
For version-specific instructions, consult Microsoft’s official .NET October 2026 out-of-band security update.
About the Author
