Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

Source data

Overview

Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.

Impact & technical details

Elevation of Privilege

Why is this third-party CVE included in the Security Update Guide? This CVE concerns a vulnerability in the Brotli library used by .NET. See the Google security advisory for information about the upstream vulnerability. For background on how Microsoft documents partner-assigned CVEs, see Security Update Guide Supports CVEs Assigned by Industry Partners .

CVSS base score

8.1 / 10

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Highest base score supplied by MSRC for this record; the vector belongs to that score. Ratings can vary by product. Microsoft Important is displayed as High; Moderate is displayed as Medium.

Affected products

• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS
• .NET 11.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS

Source guidance

Remediation

• Release Notes
• Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET.

At least one Microsoft vendor-fix reference is available. Check each affected product for its applicable update, prerequisites, and supported version.

Authoritative sources & updates

Findings and update information come from the linked publishers. GTP compiles the public record and provides the recommendation above. CVSS ratings shown here come from Microsoft. NVD references provide additional public context.

• Microsoft Security Response Center (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · 5133964 (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · 5133965 (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · 5133966 (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · Release Notes (opens in a new tab)
• Microsoft security update · Release Notes (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · Release Notes (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft security update · Release Notes (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)
• Microsoft remediation guidance (opens in a new tab)