CVE-2026-111497

Unauthenticated memory corruption in the .NET Brotli decoder: patch .NET 8, 9, 10 and 11 RC now.

CVSS 8.1
HIGH
Published Oct 25, 2026

Quick Summary

A buffer overflow (out-of-bounds write) in how .NET handles Brotli decompression lets an unauthenticated attacker read or corrupt process memory. Depending on the host, that can mean information disclosure, denial of service or elevation of privilege. Applications are at risk if they process attacker-controlled Brotli data via ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Action: update to .NET 8.0.33, 9.0.22, 10.0.14 or 11.0.0-rc.3.26522.148. .NET Framework is not affected.

Technical Details

Attack chain

1. Attacker sends a crafted Brotli stream to a service that decompresses it (an API accepting Content-Encoding: br request bodies, or a client fetching from an attacker-controlled server with automatic decompression).
2. The .NET Brotli decoder writes outside its buffer while decoding.
3. Process memory is read or corrupted, leading to a crash or, with enough effort, further compromise.

Impact Assessment

Internet-facing ASP.NET Core APIs that accept Brotli-encoded bodies are the most exposed. High attack complexity keeps the score at 8.1, but memory-safety bugs on network-reachable parsers deserve fast patching.

Microsoft Sentinel KQL Detection Queries

Two hunting queries: (1) find vulnerable .NET runtimes on onboarded endpoints via Defender Vulnerability Management data, (2) find inbound Brotli-encoded requests plus repeated .NET process crashes on IIS hosts. Adjust table names to your connectors.

// 1. Devices running .NET runtimes older than the fixed builds
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("dotnet", ".net", "aspnet")
| extend v = parse_version(SoftwareVersion)
| where (SoftwareVersion startswith "8." and v < parse_version("8.0.33"))
     or (SoftwareVersion startswith "9." and v < parse_version("9.0.22"))
     or (SoftwareVersion startswith "10." and v < parse_version("10.0.14"))
| project DeviceName, OSPlatform, SoftwareName, SoftwareVersion
| order by DeviceName asc

// 2. IIS requests with Brotli Content-Encoding (requires W3CIISLog with cs(Content-Encoding) or custom log field)
W3CIISLog
| where TimeGenerated > ago(7d)
| where csMethod in ("POST", "PUT")
| where csUserAgent != "" and scStatus in (500, 502, 503)  // failures after crafted input
| summarize Failures = count(), Clients = dcount(cIP) by sSiteName, csUriStem, bin(TimeGenerated, 1h)
| where Failures > 20  // tune to your baseline
| order by Failures desc

// 3. Repeated .NET host crashes (Application Error 1000)
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Application" and EventID == 1000
| where RenderedDescription has_any ("w3wp.exe", "dotnet.exe")
| summarize Crashes = count() by Computer, bin(TimeGenerated, 1h)
| where Crashes >= 3
| order by Crashes desc

These are hunting aids, not signature detections: no public exploit indicators exist yet, so they surface exposure and crash patterns. Validate field names against your workspace schema before enabling as analytic rules.

Mitigation & Recommendations

1. Patch: install .NET 8.0.33, 9.0.22, 10.0.14, or 11.0.0-rc.3.26522.148 (SDKs 8.0.133/8.0.427, 9.0.123/9.0.320, 10.0.114/10.0.403). Rebuild and redeploy self-contained apps and container images.
2. If you cannot patch yet: disable ASP.NET Core request decompression and HttpClient automatic decompression for Brotli, and avoid passing untrusted data to the Brotli APIs. Consider stripping Content-Encoding: br at your WAF or reverse proxy.
3. Validate: run dotnet --list-runtimes on hosts and re-run query 1 until it returns no rows.
4. Monitor: enable queries 2 and 3 as scheduled hunts for the next 30 days.

References

• GitHub Security Advisory GHSA-p3jp-9v83-76w9
• .NET October 2026 out-of-band security updates
• MSRC Security Update Guide
• NVD entry

By Sujit Mahakhud, Microsoft Sentinel specialist.