CVE-2026-111497

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A vulnerability (CVE-2026-111497) exists in the Brotli decoder that .NET uses for Brotli decompression when it processes a block switch in a category that has only one block type. An unauthenticated attacker who can supply Brotli-compressed data to an application, for example through BrotliStream, BrotliDecoder or HttpClient with automatic Brotli decompression enabled, can make the decoder read or corrupt process memory, which could lead to information disclosure, denial of service or elevation of privilege.

Per CWE-787: Out-of-bounds Write, Out-of-bounds Write is when the product writes data past the end, or before the beginning, of the intended buffer.

This issue affects .NET 6.0.47 or earlier, .NET 8.0.32 or earlier, .NET 9.0.21 or earlier and .NET 10.0.13 or earlier, on every platform.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: .NET Runtime
• Affected packages:
  • Microsoft.NETCore.App.Runtime.linux-arm
  • Microsoft.NETCore.App.Runtime.linux-arm64
  • Microsoft.NETCore.App.Runtime.linux-musl-arm
  • Microsoft.NETCore.App.Runtime.linux-musl-arm64
  • Microsoft.NETCore.App.Runtime.linux-musl-x64
  • Microsoft.NETCore.App.Runtime.linux-x64
  • Microsoft.NETCore.App.Runtime.osx-arm64
  • Microsoft.NETCore.App.Runtime.osx-x64
  • Microsoft.NETCore.App.Runtime.win-arm
  • Microsoft.NETCore.App.Runtime.win-arm64
  • Microsoft.NETCore.App.Runtime.win-x64
  • Microsoft.NETCore.App.Runtime.win-x86
• Affected versions:
  • >= 6.0.0 <= 6.0.47
  • >= 8.0.0 <= 8.0.32
  • >= 9.0.0 <= 9.0.21
  • >= 10.0.0 <= 10.0.13
• GitHub repository: https://github.com/dotnet/runtime
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  • NuGet
  • Windows Installer
  • Docker
• Fixed in:
  • OSS .NET Runtime 8.0.33, 9.0.22, 10.0.14
  • NES for .NET v6.0.48

Vulnerability Info

This High-severity vulnerability is found in the Brotli decoder in .NET 6.0.47 or earlier, .NET 8.0.32 or earlier, .NET 9.0.21 or earlier and .NET 10.0.13 or earlier. .NET compiles a copy of Google's Brotli library, version 1.0.9 in .NET 6, into the native System.IO.Compression.Native library, which backs BrotliStream, BrotliDecoder and the Brotli support in HttpClient.

A Brotli stream divides its literals, commands and distances into blocks, and a block switch moves decoding to another block type within a category. A category that declares only one block type has nowhere to switch to, so a block switch there is a format error. The vulnerable decoder did not treat it as one. Its fast decoding path ignored the failed switch and carried on with an invalid block length, and its careful path reported the stream as needing more input. Because a category with a single block type starts with a block length of 2^24 and never reloads it, a crafted stream that runs one category past that length reaches the switch, and the decoder then works from state that no longer matches its buffers, reading or writing outside them.

Credits

• Levi Broderick

Mitigation

.NET 6.x is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  • .NET Runtime >= 8.0.33
  • .NET Runtime >= 9.0.22
  • .NET Runtime >= 10.0.14
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.48 or later.