# Microsoft Emergency .NET Security Updates Fix Four Vulnerabilities (CVE-2026-111497 Brotli Buffer Overflow, CVE-2026-114148, CVE-2026-70197, CVE-2026-102870)

> Microsoft shipped out-of-band .NET updates on 2026-10-25 (8.0.33, 9.0.22, 10.0.14, 11 RC3) fixing four High-severity flaws: a Brotli decoder out-of-bounds write (CVE-2026-111497, CVSS 8.1), Linux tarball incorrect-ownership privilege escalation (CVE-2026-114148, 7.8), a Windows SocketAsyncEventArgs out-of-bounds write (CVE-2026-70197, 8.1) and a Blazor WebAssembly debugger code injection (CVE-2026-102870, 8.8). No in-the-wild exploitation, public PoC or attribution is reported.

- **Published:** 2026-10-26T08:50:21Z
- **Last reviewed:** 2026-10-26T08:50:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4438
- **ID:** TL-2026-4438
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497, CVE-2026-114148, CVE-2026-70197, CVE-2026-102870

## Description

On 2026-10-25 Microsoft published an out-of-band .NET servicing release and four security advisories (dotnet/announcements issues #492-#495). Fixed versions are .NET 8.0.33 (SDK 8.0.133/8.0.427), 9.0.22 (SDK 9.0.123/9.0.320), 10.0.14 (SDK 10.0.114/10.0.403) and .NET 11 RC3 (11.0.0-rc.3.26522.148). Coverage by GBHackers on 2026-10-26 states that CVE-2026-70197 and CVE-2026-102870 were incomplete fixes from the 2026-10-13 release.

CVE-2026-111497 (.NET Brotli Decoder Out-of-bounds Write, CWE-787, CVSS 8.1 High) affects .NET 8.0-11.0 on all platforms and architectures. Specially crafted Brotli-compressed data can let an unauthenticated attacker read or corrupt process memory, with potential information disclosure, denial of service or privilege escalation. Exposure requires an application to decompress attacker-controlled Brotli data: ASP.NET Core request decompression with Brotli enabled, HttpClient automatic response decompression configured to include Brotli, or direct use of System.IO.Compression Brotli APIs such as BrotliStream. These are not enabled by default, and .NET Framework is unaffected. Temporary mitigation is to disable Brotli decompression until patched.

CVE-2026-114148 (.NET Elevation of Privilege, CWE-276, CVSS 7.8 High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) is Linux-only. Runtime files installed from affected tarballs carry unsafe ownership metadata, so a local attacker could modify files and gain elevated privileges. Affected are Microsoft-published ASP.NET Core 8.0.0-8.0.32 and 9.0.0-9.0.21 archives and source-build tarballs for .NET 8, 9, 10 and 11. Mitigation is to extract patched archives into a new directory with tar --no-same-owner so that files and parent directories are owned by the intended trusted owner.

CVE-2026-70197 (System.Net.Sockets, CWE-787, CVSS 8.1 High, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) is Windows-only. Reusing a SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can retain an undersized buffer, enabling an unauthenticated out-of-bounds write during ReceiveFromAsync. The advisory is titled .NET and Visual Studio Remote Code Execution Vulnerability. Affected: .NET 8.0 before 8.0.33, 9.0 before 9.0.22, 10.0 before 10.0.14, 11.0 previews before rc.3.

CVE-2026-102870 (ASP.NET Core Blazor WebAssembly debugger RCE, CWE-94, CVSS 8.8 High, network vector with user interaction) affects .NET 10.0 and 11.0. The debug proxy generates source containing values originating in the debugged application (ToString() results, descriptions, class names) without consistent escaping, so code injected by a malicious application can run on the developer's machine during expression evaluation. Affected NuGet packages: Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer; updating the shared runtime alone is insufficient, the packages must be updated and the debugging environment restarted.

Self-contained applications must be rebuilt and redeployed, and containers rebuilt on updated .NET images; framework-dependent applications only need the runtime update. The sources do not report in-the-wild exploitation, a public PoC, attribution or network IOCs. Indicators below are therefore exposure/hunting indicators (vulnerable components, packages, APIs and versions) rather than adversary infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1005 Data from Local System
- T1499.004 Application or System Exploitation

## Sources

- [Microsoft Issues Emergency .NET Security Updates to Fix Four Vulnerabilities](https://gbhackers.com/microsoft-issues-emergency-net-security-updates/)
- [.NET October 2026 Out-of-Band Security Updates](https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/)
- [Microsoft Security Advisory CVE-2026-111497 | .NET Brotli Decoder Out-of-bounds Write Vulnerability](https://github.com/dotnet/announcements/issues/494)
- [Microsoft Security Advisory CVE-2026-114148 | .NET Elevation of Privilege Vulnerability](https://github.com/dotnet/announcements/issues/495)
- [.NET and Visual Studio Remote Code Execution Vulnerability (CVE-2026-70197) | October 25, 2026 OOB update](https://github.com/dotnet/announcements/issues/493)
- [ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) | October 25, 2026 OOB update](https://github.com/dotnet/announcements/issues/492)
- [dotnet/aspnetcore#70040 - CVE-2026-114148 discussion](https://github.com/dotnet/aspnetcore/issues/70040)
- [Microsoft .NET Blog](https://devblogs.microsoft.com/dotnet/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4438