Microsoft rushes .NET Brotli patch

Microsoft has issued an emergency security update for .NET to fix a flaw in Google’s Brotli compression library that the company says should be patched “as soon as possible.”

The out-of-band release applies to .NET 8, 9, 10 and 11. According to Microsoft’s advisory, the bug — tracked as CVE-2026-111497 and rated 8.1 on the CVSS scale — could let an unauthenticated attacker read or corrupt process memory. The company said the possible consequences include information disclosure, denial of service and elevation of privilege.

That is the technical description. In practice, it means a piece of software many people never think about — a compression library used to make data smaller and faster to move around — has become another reminder that ordinary infrastructure can fail in ways that are both obscure and widely shared. Brotli is built into other software, not usually installed as a conspicuous standalone tool, so the burden falls on maintainers first and users immediately after.

The Register reported that Microsoft joined Node.js, Python and other projects in releasing patches after the vulnerability was disclosed by the Node.js team on October 21. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with identifying the issue. OpenAI later said the underlying root-cause bug had actually been fixed in Brotli’s source code in February, but was not understood at the time to be a security vulnerability, and no newer Brotli release had followed.

That detail matters because it is the kind of gap that turns a coding fix into a system-wide scramble. A bug can exist in plain sight, even be corrected upstream, and still remain dangerous downstream if the security significance was not recognised and packaged software did not pick up the change.

Microsoft’s advisory, as cited by The Register, says working exploits have been assembled by researchers, but there is no indication that criminals are successfully using them in the wild. At the same time, Microsoft assesses exploitation as “more likely,” which is the sort of phrasing security teams learn not to dismiss. It does not mean catastrophe is under way; it means the path from theory to abuse is plausible enough that delay becomes a choice.

The attack route is not especially theatrical. A vulnerable system can be targeted by being fed malicious Brotli-compressed data in a crafted request. The Register also reported that researchers and vendors have linked the same flaw to software beyond web traffic, including FFmpeg through JPEG XL metadata and Apache Arrow in denial-of-service scenarios. The technical plumbing is varied; the basic problem is the same.

For administrators, this is less about a dramatic new class of attack than about how dependent modern services are on shared code buried several layers down. OpenAI, through its Patch the Planet initiative, advised blocking untrusted Brotli-compressed data where practical until patches are applied, and said affected deployments should be rebuilt and services restarted to ensure fixes take effect.

There is no evidence in the available reporting that this flaw is already being used successfully by attackers. There is enough evidence to say that the patch queue just became more urgent for anyone running .NET, and for the people who depend on those systems working without ever needing to know what Brotli is.