GoKawiilMicrosoft issues out-of-band .NET fix for critical Brotli decoder flaw
Microsoft has shipped emergency security updates for .NET 8, 9, and 10, plus .NET 11 Release Candidate 3, to fix a critical vulnerability dubbed Broccoli2Shell (CVE-2026-111497). Discovered by Imperva's Red Team, the bug is an out-of-bounds write in the Brotli decompression library that can let attackers crash apps, leak memory, or in some cases execute code remotely via crafted Brotli-compressed data.