CVE-2026-114148

Microsoftが米国時間10/25に、.NETの定例外セキュリティ更新として8.0.33、9.0.22、10.0.14と、プレビューの11 RC3を公開した。 中心はBrotliの展開ライブラリの脆弱性CVE-2026-111497で、MicrosoftのセキュリティガイドではCriticalとしている。 ただし、http://ASP.NET CoreのリクエストやHttpClientのレスポンスは、初期設定ではBrotliを自動で展開しない。 展開を有効にしているか、BrotliのAPIで外部から受け取ったデータを扱うアプリが影響を受ける。 Linux向けtarballのファイル所有者の不備による権限昇格（CVE-2026-114148）や、10/13の更新で修正が漏れていたCVE-2026-70197の修正も含まれている。 .NET Frameworkは影響を受けず、悪用は確認されていないとのこと。 .NETのアプリやビルド環境は、Brotliを使っていなくても今回の更新を当てたい。 #dotNET #脆弱性 #Microsoft #セキュリティ https://github.com/dotnet/announcements/issues/496

@KristoferA It's two new CVEs: the Brotli one (CVE-2026-111497, request and HttpClient decompression) and a Linux tarball ownership one (CVE-2026-114148). 10.0.14 has both.

@Microsoft released out-of-band patches for .NET 8/9/10 addressing a critical Brotli buffer overflow (CVE-2026-111497, CVSS 8.1) and a Linux privilege escalation flaw (CVE-2026-114148). The update also completes remediation for two remote code execution issues that received partial fixes on October 13. Applications using Brotli decompression or containerized deployments require rebuild and redistribution. #ThreatIntel #CVE #Microsoft

Same Brotli bug, now in Microsoft .NET On Oct 25 Microsoft released out-of-band updates for .NET 8, 9, 10 and .NET 11 Release Candidate 3 for CVE-2026-111497. The Brotli decoder can overflow a buffer when it unpacks a crafted compressed stream, which can leak memory, crash the process, or raise privileges. Microsoft rates it High at CVSS 8.1. Default http://ASP.NET Core and HttpClient setups do not unpack Brotli automatically. Apps are exposed when they turn on Brotli request or response decompression, or call BrotliStream / BrotliDecoder on untrusted data. .NET Framework is not affected. Microsoft says it is not known to be exploited. The same release also fixes CVE-2026-114148, a Linux tarball ownership flaw that can let a local account raise privileges. Update to runtime 8.0.33, 9.0.22 or 10.0.14 (and .NET 11 RC3). Rebuild self-contained apps and containers. Sources: .NET October 2026 OOB updates: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/ Microsoft Security Advisory CVE-2026-111497: https://github.com/dotnet/announcements/issues/494 Microsoft Security Advisory CVE-2026-114148: https://github.com/dotnet/announcements/issues/495 MSRC CVE-2026-111497: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497

Microsoft's out-of-band .NET security update fixes Brotli flaw CVE-2026-111497 and Linux tarball bug CVE-2026-114148. Update to 8.0.33 or 9.0.22. #DotNET #Microsoft #Brotli #CVE2026111497 #CVE2026114148 #CVE202670197 #ASPNETCore #CyberSecurity https://securityonline.info/dotnet-security-update-brotli-october-2026/