Microsoft releases emergency .NET patches for critical Brotli flaw

Microsoft released emergency out-of-band security updates on Sunday, October 26, 2026, to address a critical vulnerability tracked as CVE-2026-111497 across supported .NET versions. Uncovered by the Imperva Red Team, the security defect is commonly known as Broccoli2Shell and is also tracked as Node2Shell and HTTP2Shell. As detailed in BleepingComputer's report, the flaw enables unprivileged attackers to trigger memory leaks, crash applications, or execute arbitrary code. Microsoft advised engineering teams and administrators to deploy the new security updates as soon as possible across all affected production systems.

This article covers the technical mechanics of the Brotli decoder vulnerability, the specific software versions affected, practical mitigation strategies, and the required patching steps. It is written for systems administrators, enterprise software engineers, and DevOps teams responsible for maintaining .NET applications and web services. Readers will learn how non-default configurations create risk, why host-level library updates may prove insufficient for bundled applications, and how to verify patch installations across production environments before exploit code becomes weaponized in active, real-world cyber attacks.

What broke in Microsoft emergency .NET patches for critical

The underlying failure stems from an out-of-bounds write flaw discovered inside the Brotli decoder, which decompresses data formatted using Google's Brotli lossless compression algorithm. Identified by the Imperva Red Team, the security bug occurs when the decompression routine processes an intentionally malformed input stream. Instead of safely discarding invalid data, the decoder mismanages memory offsets and writes bytes beyond its allocated buffer limits. This memory corruption compromises application stability, giving remote actors an entry point to disrupt services without needing administrative privileges.

Exploitation of this out-of-bounds write defect enables unprivileged attackers to trigger application crashes, initiate memory leaks, or achieve arbitrary remote code execution on vulnerable devices. According to the security advisory released by Microsoft, attackers can also leverage the vulnerability to remotely escalate privileges on unpatched systems running non-default configurations. The flaw undermines standard memory safety boundaries across affected binaries, allowing malformed payload streams to hijack execution flow or compromise underlying server environments whenever vulnerable decompression routines process incoming untrusted network data.

Who is exposed by Microsoft emergency .NET patches for critical

Exposure to CVE-2026-111497 is governed by how individual applications configure their data decompression pipelines. Microsoft explained in its advisory that "Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET." As a result, standard installations that do not activate these specific decompression features are not directly exposed to external exploitation.

Systems that manually enable decompression face immediate exposure. Microsoft stated that "Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs." Web services accepting compressed HTTP requests from untrusted clients, microservices consuming upstream compressed responses, and custom utilities utilizing System.IO.Compression APIs fall squarely within the vulnerable attack surface. Furthermore, apps bundling custom copies of the Brotli library remain exposed regardless of whether host operating system libraries are patched.

What to do now about Microsoft emergency .NET patches for critical

Administrators must deploy Microsoft's out-of-band updates across all impacted .NET installations without delay. Microsoft released version 8.0.33 for .NET 8, version 9.0.22 for .NET 9, and version 10.0.14 for .NET 10, alongside Release Candidate 3 for the preview version of .NET 11. These patches deliver updated SDK and Runtime builds designed to address the memory write defect directly. Microsoft advised updating as soon as possible, emphasizing that deployment should cover application servers, developer workstations, container base images, and continuous integration pipelines running supported framework versions.

For environments where security patches cannot be installed immediately, teams should implement defensive mitigations to block exploitation attempts. Administrators can configure network firewalls, reverse proxies, or load balancers to drop or reject incoming HTTP requests containing Brotli-compressed content. Within application configurations, engineers should temporarily disable ASP.NET Core request decompression and HttpClient automatic response decompression routines. Alternatively, developers can temporarily remove code invoking the System.IO.Compression Brotli APIs, preventing vulnerable decoder routines from executing untrusted input streams until official runtime updates can be deployed.

How the Microsoft emergency .NET patches for critical issue works

The vulnerability operates through an out-of-bounds write flaw in the native Brotli decompression logic during payload processing. When an application receives compressed data, it routes the byte sequence through the Brotli decoder to reconstruct the original data stream. An attacker crafts a malicious compressed stream containing corrupted block lengths and malformed metadata headers. When the Brotli decoder parses these manipulated values, its internal index calculations fail, causing the decoder to write uncompressed bytes past the boundaries of its memory buffer and corrupt adjacent heap or stack structures.

This memory corruption allows attackers to alter program execution flow and achieve remote code execution. Because decompression occurs before application-level authentication checks, unauthenticated network traffic can directly trigger the corrupted memory state. On unpatched systems with non-default configurations, attackers can chain the corrupted memory buffers to execute arbitrary instructions under the host process context or remotely escalate system privileges. In environments with vulnerable Brotli binaries, this mechanism turns untrusted network payloads into full remote access vectors without requiring valid user credentials.

What is still unknown about Microsoft emergency .NET patches

Uncertainty remains regarding when threat actors will weaponize the flaw, even though proof-of-concept exploits for Broccoli2Shell have already been published on GitHub. While no confirmed reports of malicious exploitation in the wild have emerged yet, public proof-of-concept scripts give adversaries ready-made templates for crafting attack payloads. Threat actors often scan public IP ranges for exposed endpoints once technical details become public. The window between patch availability and widespread automated scanning represents the most dangerous phase for organizations running non-default .NET configurations.

Another unresolved challenge is the extent of embedded and bundled Brotli libraries scattered across production environments. A dedicated online tracking portal established for the vulnerability warns that updating the system Brotli library does not resolve the risk in applications that bundle their own private copy of the library. Many commercial applications, microservices, and third-party containers bundle internal copies of Brotli binaries that bypass standard operating system package updates. Security teams face ongoing uncertainty in identifying all embedded instances, requiring thorough code audits and dependency scans.