.NET ships out-of-band security update for Brotli buffer overflow CVE
unixterminal · x · 2026-10-26
Microsoft released out-of-band security updates over the weekend for .NET 8, 9, 10, and .NET 11 RC3, urging users to update ASAP:
- CVE-2026-111497: Buffer overflow in .NET's use of Brotli decompression; an unauthenticated attacker could read or corrupt process memory, leading to info disclosure, DoS, or privilege elevation. Affects all platforms, including apps using ASP.NET Core request decompression or HttpClient automatic decompression.
- CVE-2026-114148: Unsafe ownership metadata in Linux .NET tarballs could let a local attacker modify files and gain elevated privileges.
More from coding & agent
- Writing evals may become AI's highest-paying job: whoever owns the rubric controls agent output — hwchase17 · 2026-10-26
- Perspective paper: Agentic memory management is the next frontier of information retrieval — _reachsumit · 2026-10-26
- Skillry launches a paid marketplace of "taste" skills for Claude Code, Codex and Cursor — yihui_indie · 2026-10-26
- Codex CLI's cyberpunk voice-token animation is just a split-flap airport board — arthurcolle · 2026-10-26
- Open-source 'be-ambitious' skill rewrites your prompt into an expert-level task — daniel_mac8 · 2026-10-26
- Engineer swears praising Codex ('youre doing a great job <3') gets better results — enggirlfriend · 2026-10-26