CVE-2026-111497: Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

Overview

Severity

High (CVSS 8.1)

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

More Likely

Publicly Disclosed

Yes

Patch Tuesday

2026-Oct

Released

2026-10-25

EPSS Score

32.78% (percentile: 98.3%)

Description

Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.

FAQ

Why is this third-party CVE included in the Security Update Guide? This CVE concerns a vulnerability in the Brotli library used by .NET. See the Google security advisory for information about the upstream vulnerability. For background on how Microsoft documents partner-assigned CVEs, see Security Update Guide Supports CVEs Assigned by Industry Partners.

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 40 repositories

Affected Products (19)

Developer Tools

• .NET 8.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 9.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 11.0 installed on Windows
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS
• Microsoft Visual Studio 2019 version 16.11
• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.11
• Microsoft Visual Studio 2026 version 18.12
• PowerShell 7.6
• PowerShell 7.5
• PowerShell 7.4

Security Updates (10)

• 5133964
• 5133965
• 5133966
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes

Acknowledgments

Henrique Pereira with Microsoft, Henrique Pereira with Microsoft, <a href="https://x.com/xamroot">Max Toor</a> with Microsoft, Henrique Pereira with Microsoft

Revision History

• 2026-10-25: Information published.