14/11/2026
Critical Windows & Microsoft Libraries & Open Source
About 4 min read

CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw

CVE-2026-111497 .NETWindows

Microsoft disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by .NET that could enable elevation of privilege over a network. Exposure requires an application to use Brotli decompression; check affected products and versions, then install the applicable update.

CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw

At a glance

  • CVE-2026-111497 is an out-of-bounds write in the Brotli decoder used by .NET.
  • The flaw could enable elevation of privilege over a network; exposure requires an application to use Brotli decompression.
  • The vulnerability is public; the source reports no exploitation in the wild.
  • Check products and versions, then install the applicable updates.
In this article

Microsoft has released updates for CVE-2026-111497, a flaw in the Brotli decoder used by .NET. The vulnerability could enable elevation of privilege over a network, but an application must actively use Brotli decompression to meet the stated exposure condition. See the Microsoft security guide for details and updates by product.

Overview and technical details

Brotli is a data compression and decompression library used by .NET. CVE-2026-111497 is classified as an out-of-bounds write; Microsoft says the flaw could allow an unauthenticated attacker to elevate privileges over a network.

FieldDetails
IdentifierCVE-2026-111497
Vulnerability typeCWE-787: Out-of-bounds Write
CVSSCVSS 3.1: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
SeverityCritical
StatusPublicly disclosed: Yes; exploitation in the wild: No
SourceMicrosoft MSRC

Affected systems

Brotli decompression is not enabled by default in out-of-the-box .NET or ASP.NET Core settings. An application may meet the exposure condition if it actively enables ASP.NET Core request decompression, HttpClient response decompression, or calls a .NET Brotli decompression API. Microsoft lists the following affected products and versions with their corresponding updates:

Affected product and versionUpdate or build
Windows 11 Version 23H2 for ARM64-based Systems; Windows 11 Version 23H2 for x64-based SystemsKB5131087, Build 10.0.22631.7711
Windows 11 Version 26H1 for ARM64-based Systems; Windows 11 version 26H1 for x64-based SystemsKB5132059, Build 10.0.28000.3501
Windows 10 Version 21H2 for x64-based Systems; Windows 10 Version 21H2 for ARM64-based Systems; Windows 10 Version 21H2 for 32-bit SystemsKB5131096, Build 10.0.19044.7846
Windows Server 2025; Windows Server 2025 (Server Core installation)KB5131080, Build 10.0.26100.33822; KB5131077, Build 10.0.26100.33730
Windows 10 Version 22H2 for ARM64-based Systems; Windows 10 Version 22H2 for 32-bit Systems; Windows 10 Version 22H2 for x64-based SystemsKB5131096, Build 10.0.19045.7846
Windows 11 Version 24H2 for x64-based Systems; Windows 11 Version 24H2 for ARM64-based SystemsKB5132061, Build 10.0.26100.9974; KB5132043, Build 10.0.26100.9911
Windows 11 Version 25H2 for x64-based Systems; Windows 11 Version 25H2 for ARM64-based SystemsKB5132061, Build 10.0.26200.9974; KB5132043, Build 10.0.26200.9911
Windows Server 2022 (Server Core installation); Windows Server 2022KB5131090, Build 10.0.20348.5870
Windows Server 2019 (Server Core installation); Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for 32-bit Systems; Windows Server 2019KB5131085, Build 10.0.17763.9487
Windows 11 Version 26H2 for ARM64-based Systems; Windows 11 Version 26H2 for x64-based SystemsKB5132061, Build 10.0.26300.9974; KB5132043, Build 10.0.26300.9911
azl3 qemu10.1.0-2; 10.1.0-1
azl3 p7zip16.02-23
Microsoft Visual Studio 2017 version 15.9Build 15.9.84
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)Build 1416/1.0.0.2026202302
azl3 nodejs24.21.0-1, Build 24.22.1-1
azl3 brotli1.1.0-2, Build 1.2.1-1
PowerShell 7.6Build 7.6.9
.NET 10.0 installed on Mac OS; .NET 10.0 installed on Linux; .NET 10.0 installed on WindowsKB5133966, Build 10.0.403
Microsoft Visual Studio 2022 version 17.14Build 17.14.43
Microsoft Visual Studio 2026 version 18.11Build 18.11.2
Microsoft Visual Studio 2026 version 18.12 InsidersBuild 18.12 Insiders 3

Mechanism and impact

The flaw is in the Brotli decoder used by .NET. When an application meets the condition of using Brotli decompression, an unauthenticated attacker could exploit the flaw over a network to elevate privileges. The source reports no exploitation in the wild.

Exploitation status

The vulnerability is public, but Microsoft reports no exploitation in the wild. Public disclosure and exploitation in real-world environments are distinct statuses.

System checks

  1. On Windows, check whether the relevant KBs are installed:

    Get-HotFix -Id KB5131087,KB5132059,KB5131096,KB5131080,KB5131077,KB5132061,KB5132043,KB5131090,KB5131085

    Match the KB to the Windows version in use. If the relevant KB is not found, check the operating system version and build, then install the applicable update.

  2. List the .NET runtimes installed on the system:

    dotnet --list-runtimes

    If the system has .NET 10.0, compare the listed runtime with the .NET 10.0 Build 10.0.403 update.

Remediation and mitigation

  1. Prioritize installing the updates or KBs corresponding to the affected product and version listed above.

  2. Review applications that actively enable ASP.NET Core request decompression, HttpClient response decompression, or call a .NET Brotli decompression API; these are the stated conditions that may create exposure.

Reference: Microsoft Security Response Center (MSRC), CVE-2026-111497

References: Microsoft MSRC

Related articles