Details of the Emergency Security Updates
Microsoft announced the release of emergency out-of-band (OOB) security updates targeting .NET 8, .NET 9, and .NET 10, in addition to the Release Candidate 3 (RC3) of .NET 11. This step comes to address recently discovered security vulnerabilities that require immediate intervention by developers and system administrators to ensure the security of working environments.
Addressed Security Vulnerabilities
The updates include fixes for two main vulnerabilities:
- CVE-2026-111497: A buffer overflow vulnerability within the Brotli compression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory, potentially leading to sensitive information disclosure, denial of service, or elevation of privilege. This vulnerability affects all platforms.
- CVE-2026-114148: A vulnerability related to insecure file ownership data in .NET tarball files on Linux systems, which could allow a local attacker to modify files and gain elevated privileges.
In addition, Microsoft re-issued updates to address previous vulnerabilities (CVE-2026-70197 and CVE-2026-102870) after it was found that the updates released on October 13, 2026, did not completely resolve the issues.
What Developers Should Do
Update procedures vary based on the type of application used:
- Framework-dependent applications: The updated runtime for the targeted version must be installed and the application restarted.
- Self-contained applications: This requires rebuilding and redeploying the application using the updated runtime, as bundled components are not updated automatically.
- Containers: Images must be rebuilt and deployed using the updated .NET container images.
- Tarball users: ASP.NET Core users on .NET 8 and 9 versions must update their installations using the updated tarball files.
Users can check the currently installed runtime versions via the command dotnet --list-runtimes to ensure that updates are applied correctly.