Microsoft ships emergency .NET fixes for critical Brotli flaw

What happened?

Microsoft released out-of-band security updates for .NET, Visual Studio and PowerShell on Sunday, outside its normal release schedule. The patches address a buffer overflow vulnerability (CVE-2026-111497) in Brotli, Google's widely used compression library.

Who found it?

OpenAI's Codex Security team reported the flaw. Microsoft shared details of the fix in a .NET blog post.

Broad impact

Brotli is not limited to Microsoft products; it is embedded in many projects. Node.js, Python packages, proxies and other tools that bundle the library are also releasing fixed versions. The update is therefore expected to extend beyond the .NET ecosystem.

What is a buffer overflow?

A buffer overflow occurs when a program writes more data than the allocated memory space allows. Attackers can use such flaws to crash a program or execute malicious code. Because compression libraries like Brotli process data coming over the network, these bugs create a wide attack surface.

What to do

Teams running applications, packages and infrastructure components that use the Brotli library are advised to apply vendor patches as soon as possible.