Microsoft 釋出 .NET 緊急安全更新：四項漏洞已修復
Microsoft Releases Out-of-Band .NET Security Updates: Four Vulnerabilities Addressed
Microsoft 於 2026 年 10 月 25 日釋出 .NET 緊急安全更新，修復四項關鍵漏洞。
- 漏洞：CVE-2026-111497 (Brotli 解碼器緩衝區溢位) 可能導致資訊外洩、服務拒絕或特權提升。
Microsoft 針對 .NET 8-11 發布緊急安全更新，修復四項關鍵漏洞，組織應即時檢查並升級以防止資料外洩與執行惡意程式。
Microsoft released out-of-band security updates for .NET on October 25, 2026, outside its regular monthly servicing schedule.
The release addresses a buffer overflow vulnerability in Brotli decompression, an unsafe Linux tarball ownership issue, and two vulnerabilities for which the October 13 security updates did not fully resolve the underlying issues.
Organisations running .NET applications should review their deployments and apply the relevant updates.
1. CVE-2026-111497 — Brotli Decoder Buffer Overflow
A buffer overflow vulnerability in .NET’s Brotli decompression functionality could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or privilege escalation.
Applications may be exposed when they process untrusted compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs.
Automatic request and response decompression are not enabled by default. Exposure depends on how the application uses the affected functionality.
2. CVE-2026-114148 — Linux Tarball Ownership
Unsafe file-ownership metadata in affected Linux .NET tarballs could allow a local attacker to modify files and gain elevated privileges.
The scope depends on the .NET version and distribution:
- .NET 8 and .NET 9: Certain ASP.NET Core runtime and targeting-pack tarballs, along with source-built Linux distributions, are affected.
- .NET 10 and .NET 11: The issue affects source-built Linux tarball distributions.
Organisations using affected installation methods should obtain the updated artifacts and remediate existing installations as directed by Microsoft.
3. CVE-2026-70197 — SocketAsyncEventArgs Memory Corruption
Microsoft has reissued this advisory because the October 13 update did not fully address the vulnerability.
The October 25 release provides the corrected fix for .NET 8, .NET 9, .NET 10, and .NET 11. Organisations that installed the earlier update should verify that they have moved to the newly patched release.
4. CVE-2026-102870 — Blazor WebAssembly Debugger Remote Code Execution
This vulnerability affects .NET 10 and .NET 11. Microsoft has corrected the earlier fix in the October 25 release.
For affected Blazor deployments, update the relevant Microsoft.AspNetCore.Components.WebAssembly.Server and Microsoft.AspNetCore.Components.WebAssembly.DevServer package references. Updating the shared runtime alone does not update these packages.
Fixed Versions
Install the appropriate release for your environment:
- .NET 8: 8.0.33
- .NET 9: 9.0.22
- .NET 10: 10.0.14
- .NET 11: Release Candidate 3
.NET 11 RC2 users should upgrade to RC3 to receive the fixes.
.NET Framework is not affected by the Brotli vulnerability described in this advisory.
What Organisations Should Do
- Update installed runtimes and SDKs: Deploy the latest applicable release and restart affected applications.
- Rebuild self-contained applications: Publish them with the updated runtime because updating the host does not replace the runtime bundled with an application.
- Update containers: Rebuild and redeploy using patched .NET container images.
- Review Linux installations: Check whether affected tarballs or source-built distributions are in use, and remediate existing installations as required.
- Update Blazor packages: Verify the affected package references and deploy the patched versions.
- Validate the outcome: Check runtime and package versions and confirm that production workloads are using the corrected builds.
The command below lists shared .NET runtimes installed on a machine:
dotnet --list-runtimes
This does not identify every runtime bundled with self-contained or NativeAOT applications, so those deployments require separate verification.
Conclusion
The October 25 release deserves attention not only because of the Brotli vulnerability, but also because two earlier security fixes required correction.
Organisations should not assume that installing the October 13 updates is sufficient. Review the affected components, deploy the appropriate patched versions, and verify remediation across runtimes, application packages, containers, and Linux installations.
The objective is simple: patch the affected components and confirm that the fixes are present in production.