.NET's emergency updates require rebuilding bundled runtimes

Microsoft released emergency .NET updates on October 25, covering supported runtime lines and .NET 11 Release Candidate 3. Rahul Bhandari’s release notice also says two October 13 security fixes were incomplete. Those installations need another update.

The new releases address Brotli decompression and Linux tarball ownership, with different exposure conditions. Updating the runtime installed on a host fixes only applications that actually use that runtime.

Match the fix to the deployment

Microsoft identifies these update targets:

For framework-dependent applications, which use a host-installed runtime, install the matching update and restart the application. For self-contained applications, which bundle their runtime, rebuild and republish with the updated runtime. Rebuild and redeploy containers from updated .NET images too.

A newer host runtime leaves embedded copies unchanged. Check the deployed application and image, not just the machine’s installed runtime list.

Brotli exposure requires a decoding path

CVE-2026-111497 affects .NET’s use of Brotli, a compression format. Microsoft says malformed input can read or corrupt process memory, potentially causing information disclosure, denial of service or elevated privileges.

The Microsoft advisory identifies these paths:

• ASP.NET Core request decompression, when the application enables it.
• HttpClient automatic response decompression, when enabled for downloaded responses.
• Direct use of the System.IO.Compression Brotli APIs.

Request and automatic response decompression are off by default. .NET Framework is unaffected. An application consuming malicious compressed responses can expose the decoder even when it accepts no public requests.

This is the same upstream Brotli issue already covered for Node.js and Python. Microsoft’s new releases supply separate .NET remediation; updating Node.js or Python leaves these runtime copies unchanged.

Linux tarball ownership is a local privilege problem

CVE-2026-114148 concerns unsafe ownership metadata in Linux distribution archives. Microsoft says an attacker with local access could modify files and gain elevated privileges.

The release notice distinguishes the affected delivery paths:

• .NET 10 and 11: source-build tarballs only. Obtain updated artifacts and rebuild the packages.
• .NET 8 and 9: source-build artifacts and ASP.NET Core tarballs. Users of the latter need refreshed Runtime tarballs even when they never build .NET from source.

That condition is separate from an internet-facing application’s Brotli settings. Confirm how the installation was obtained before deciding that one exposure check covers both flaws.

October 13 patching was insufficient for two other issues

Microsoft says today’s updates complete fixes for CVE-2026-70197, memory corruption involving SocketAsyncEventArgs, across .NET 8 through 11. They also repair CVE-2026-102870, affecting the Blazor WebAssembly debugger in .NET 10 and 11.

The debugger advisory describes attacker-supplied data reaching an application being debugged. Exploitation requires a developer to evaluate an affected object during that debugging session. It is a development-workstation exposure condition, not a claim that every production Blazor site runs attacker code.

Exploitation status: vendor-confirmed vulnerabilities and available fixes. Microsoft’s advisory data marked all four CVEs “exploited: No” at review. That is its reported status, not proof that attacks cannot have occurred.

Caveat: Microsoft supplies the affected-product guidance; older advisory revision notes are terse, so use the explicit October 25 release notice for the replacement-update requirement.