Threat reportVulnerabilityTL-2026-4438
Microsoft Emergency .NET Security Updates Fix Four Vulnerabilities (CVE-2026-111497 Brotli Buffer Overflow, CVE-2026-114148, CVE-2026-70197, CVE-2026-102870)
Microsoft Emergency .NET Security Updates Fix Four (TL-2026-4438), also tracked as October 2026 .NET Out-of-Band Security Update, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-26. It has no confirmed attribution, affects Microsoft .NET (runtime, ASP.NET Core, System.IO.Compression Brotli), references 4 CVEs (CVE-2026-111497, CVE-2026-114148, CVE-2026-70197), maps to 4 MITRE ATT&CK techniques (T1005, T1190, T1203), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4438
- Threat ID
- TL-2026-4438
- Also known as
- October 2026 .NET Out-of-Band Security Update
- Severity
- HIGH
- CVSS
- 8.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Microsoft Emergency .NET Security Updates Fix Four
Malware and tooling: httpclient - S0068
How Microsoft Emergency .NET Security Updates Fix Four works
Microsoft shipped out-of-band .NET updates on 2026-10-25 (8.0.33, 9.0.22, 10.0.14, 11 RC3) fixing four High-severity flaws: a Brotli decoder out-of-bounds write (CVE-2026-111497, CVSS 8.1), Linux tarball incorrect-ownership privilege escalation (CVE-2026-114148, 7.8), a Windows SocketAsyncEventArgs out-of-bounds write (CVE-2026-70197, 8.1) and a Blazor WebAssembly debugger code injection (CVE-2026-102870, 8.8). No in-the-wild exploitation, public PoC or attribution is reported.
On 2026-10-25 Microsoft published an out-of-band .NET servicing release and four security advisories (dotnet/announcements issues #492-#495). Fixed versions are .NET 8.0.33 (SDK 8.0.133/8.0.427), 9.0.22 (SDK 9.0.123/9.0.320), 10.0.14 (SDK 10.0.114/10.0.403) and .NET 11 RC3 (11.0.0-rc.3.26522.148). Coverage by GBHackers on 2026-10-26 states that CVE-2026-70197 and CVE-2026-102870 were incomplete fixes from the 2026-10-13 release.
CVE-2026-111497 (.NET Brotli Decoder Out-of-bounds Write, CWE-787, CVSS 8.1 High) affects .NET 8.0-11.0 on all platforms and architectures. Specially crafted Brotli-compressed data can let an unauthenticated attacker read or corrupt process memory, with potential information disclosure, denial of service or privilege escalation. Exposure requires an application to decompress attacker-controlled Brotli data: ASP.NET Core request decompression with Brotli enabled, HttpClient automatic response decompression configured to include Brotli, or direct use of System.IO.Compression Brotli APIs such as BrotliStream. These are not enabled by default, and .NET Framework is unaffected. Temporary mitigation is to disable Brotli decompression until patched.
CVE-2026-114148 (.NET Elevation of Privilege, CWE-276, CVSS 7.8 High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) is Linux-only. Runtime files installed from affected tarballs carry unsafe ownership metadata, so a local attacker could modify files and gain elevated privileges. Affected are Microsoft-published ASP.NET Core 8.0.0-8.0.32 and 9.0.0-9.0.21 archives and source-build tarballs for .NET 8, 9, 10 and 11. Mitigation is to extract patched archives into a new directory with tar --no-same-owner so that files and parent directories are owned by the intended trusted owner.
CVE-2026-70197 (System.Net.Sockets, CWE-787, CVSS 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) is Windows-only. Reusing a SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can retain an undersized buffer, enabling an unauthenticated out-of-bounds write during ReceiveFromAsync. The advisory is titled .NET and Visual Studio Remote Code Execution Vulnerability. Affected: .NET 8.0 before 8.0.33, 9.0 before 9.0.22, 10.0 before 10.0.14, 11.0 previews before rc.3.
CVE-2026-102870 (ASP.NET Core Blazor WebAssembly debugger RCE, CWE-94, CVSS 8.8 High, network vector with user interaction) affects .NET 10.0 and 11.0. The debug proxy generates source containing values originating in the debugged application (ToString() results, descriptions, class names) without consistent escaping, so code injected by a malicious application can run on the developer's machine during expression evaluation. Affected NuGet packages: Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer; updating the shared runtime alone is insufficient, the packages must be updated and the debugging environment restarted.
Self-contained applications must be rebuilt and redeployed, and containers rebuilt on updated .NET images; framework-dependent applications only need the runtime update. The sources do not report in-the-wild exploitation, a public PoC, attribution or network IOCs. Indicators below are therefore exposure/hunting indicators (vulnerable components, packages, APIs and versions) rather than adversary infrastructure.
MITRE ATT&CK techniques used in TL-2026-4438
Collection
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Impact
Affected products and versions in Microsoft Emergency .NET Security Updates Fix Four
- Microsoft — .NET (runtime, ASP.NET Core, System.IO.Compression Brotli)
Vulnerable versions: 8.0.0-8.0.32; 9.0.0-9.0.21; 10.0.0-10.0.13; 11.0 previews before rc.3
Fixed in: 8.0.33; 9.0.22; 10.0.14; 11.0.0-rc.3.26522.148 - Microsoft — .NET Linux tarballs (ASP.NET Core 8/9 archives, source-build 8-11)
Vulnerable versions: ASP.NET Core 8.0.0-8.0.32; ASP.NET Core 9.0.0-9.0.21; source-build 8.0.100-8.0.132; source-build 9.0.100-9.0.122
Fixed in: 8.0.33; 9.0.22; 8.0.133; 9.0.123 - Microsoft — Microsoft.AspNetCore.Components.WebAssembly.Server / DevServer
Vulnerable versions: .NET 10.0 and 11.0 preview package versions before the fix
Fixed in: Patched 10.0 and 11.0 package versions per advisory
Remediation for Microsoft Emergency .NET Security Updates Fix Four
Patches
- CVE-2026-111497: 8.0.33 / 9.0.22 / 10.0.14 / 11.0.0-rc.3.26522.148
- CVE-2026-114148: ASP.NET Core 8.0.33 / 9.0.22 archives; source-build 8.0.133 / 9.0.123 and corresponding 10/11 releases
- CVE-2026-70197: 8.0.33 / 9.0.22 / 10.0.14 / 11.0.0-rc.3.26522.148 (Windows)
- CVE-2026-102870: update runtime plus Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer packages (.NET 10/11)
Immediate actions
- Update to .NET 8.0.33, 9.0.22, 10.0.14 or 11.0.0-rc.3.26522.148 (SDKs 8.0.133/8.0.427, 9.0.123/9.0.320, 10.0.114/10.0.403)
- Rebuild and redeploy self-contained applications and rebuild containers on updated .NET images
- Inventory applications using BrotliStream, ASP.NET Core request decompression or HttpClient automatic decompression with Brotli
Workarounds
- Disable Brotli decompression in ASP.NET Core request decompression and HttpClient automatic decompression until patched
- Extract patched Linux tarballs to a new directory using tar --no-same-owner so a trusted owner controls files and parent directories
- Restart debugging environments after updating the Blazor WebAssembly packages
Longer-term hardening
- Track .NET servicing via dotnet/announcements and re-verify that earlier incomplete fixes (CVE-2026-70197, CVE-2026-102870) are superseded
- Do not debug untrusted Blazor WebAssembly applications on workstations holding sensitive credentials
- Keep tarball-installed runtimes owned by a trusted account and verify file ownership after install
CVEs associated with Microsoft Emergency .NET Security Updates Fix Four
CVE-2026-111497, CVE-2026-114148, CVE-2026-70197, CVE-2026-102870
Weaknesses (CWE) in Microsoft Emergency .NET Security Updates Fix Four
Timeline of Microsoft Emergency .NET Security Updates Fix Four
- Microsoft's regular October .NET release ships initial fixes later reported as incomplete for CVE-2026-70197 and CVE-2026-102870
- Guidance issued: disable Brotli decompression as interim mitigation; extract Linux tarballs with tar --no-same-owner; rebuild self-contained apps and containers
- dotnet/announcements advisories #492-#495 published for CVE-2026-102870, CVE-2026-70197, CVE-2026-111497 and CVE-2026-114148 (CVSS 8.8, 8.1, 8.1, 7.8)
- Rahul Bhandari (Microsoft) publishes the .NET October 2026 Out-of-Band Security Updates post covering the Brotli decoder and tarball ownership flaws
- Microsoft releases out-of-band .NET 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148
- GBHackers reports the emergency updates; no exploitation, PoC or attribution stated
Sources cited for Microsoft Emergency .NET Security Updates Fix Four
- Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities
- .NET October 2026 Out-of-Band Security Updates
- Microsoft Security Advisory CVE-2026-111497 | .NET Brotli Decoder Out-of-bounds Write Vulnerability
- Microsoft Security Advisory CVE-2026-114148 | .NET Elevation of Privilege Vulnerability
- .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2026-70197) | October 25, 2026 OOB update
- ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) | October 25, 2026 OOB update
- dotnet/aspnetcore#70040 - CVE-2026-114148 discussion
- Microsoft .NET Blog
Detection coverage for TL-2026-4438
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4438 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.