What Microsoft released
Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, on 25 October 2026, and recommends updating as soon as possible. Out-of-band means outside the normal monthly schedule. The October release had shipped on 13 October, and two of its fixes turned out to be incomplete.
The patched releases are .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3. Developers on .NET 11 RC2 must move to RC3 to receive these fixes. Our coverage of the 13 October release is here: Microsoft Patch Tuesday October 2026.
GBHackers independently reported the same four-vulnerability scope, the same patched releases, and the same update actions.
The four flaws
CVE-2026-111497: Brotli buffer overflow. A buffer overflow in .NET’s use of the Brotli decompression algorithm, affecting all platforms. An unauthenticated attacker could read or corrupt process memory, which could lead to information disclosure, denial of service, or elevation of privilege. Applications are affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Two limits matter here: request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected.
CVE-2026-114148: Linux tarball ownership. Unsafe ownership metadata in affected .NET tarballs could allow a local attacker on Linux to modify files and gain elevated privileges. For .NET 10 and .NET 11, only source-build tarballs are affected. For .NET 8 and .NET 9, ASP.NET Core distributions obtained through ASP.NET Core tarballs are also affected, including for users who do not build .NET from source.
CVE-2026-70197: SocketAsyncEventArgs memory corruption. This affects .NET 8, 9, 10 and 11. Microsoft re-released this advisory because the 13 October release did not fully address it.
CVE-2026-102870: Blazor WebAssembly debugger. This affects .NET 10 and 11, and was re-released for the same reason: the 13 October fix was incomplete.
What to do now
Microsoft’s instructions depend on how the application is deployed:
- Framework-dependent applications: install the updated runtime, then restart the application.
- Self-contained applications: rebuild and republish with the updated runtime, because installing a newer host runtime does not update the bundled runtime.
- Containers: rebuild and redeploy using updated .NET container images.
- Source-build consumers: obtain the updated source-build artifacts and rebuild packages to include the tarball ownership fix.
- ASP.NET Core tarball users on .NET 8 and 9: update using the refreshed ASP.NET Core Runtime tarball, even if you do not build .NET from source.
Check installed runtimes with dotnet --list-runtimes. Self-contained applications and container deployments must be checked separately, because they carry their own runtime. For framework-dependent deployments, confirm that the updated runtime for your version is installed before considering the update complete. The download links for each patched release are published in Microsoft’s post, alongside the .NET deployment documentation for framework-dependent and self-contained applications. If you encounter a problem after updating, Microsoft points users to the .NET release feedback issues on GitHub.
Why this update is different
This section is TechReview’s own analysis, based only on Microsoft’s dates. Twelve days passed between the 13 October release and the 25 October out-of-band correction. One emergency release provides fixes for four flaws, but only two are new: the other two are re-released advisories for fixes that did not fully land on 13 October. That is the story here, an emergency release that exists because the scheduled release fell short on two items.
Two things this article deliberately does not claim. Microsoft’s post publishes no CVSS scores for these flaws, so scores circulating in secondary coverage are not repeated here as Microsoft-confirmed. And neither Microsoft’s post nor GBHackers’ report states in-the-wild exploitation, so this article claims neither that these flaws are exploited nor that they are not.
Sources
Microsoft .NET Blog, “.NET October 2026 Out-of-Band Security Updates”, 25 October 2026: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
GBHackers, “Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities”, 26 October 2026: https://gbhackers.com/microsoft-issues-emergency-net-security-updates/
