Vulnerabilities

Vulnerability · GHSA-p3jp-9v83-76w9

Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Published Nov 3, 2026 · catalog updated Nov 3, 2026 · Microsoft Security Advisory -

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-p3jp-9v83-76w9. A missing EPSS score is not a low risk. Compare Microsoft Security Advisory - with the linked advisory before you change production.

Severity

High8.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

nuget Microsoft.DotNet.ILCompiler · nuget Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64 · nuget Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64 · nuget Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64 · nuget Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-arm64 · nuget Microsoft.NETCore.App.Runtime.NativeAOT.linux-bionic-x64

## Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression APIs to process attacker-controlled data, as described below. .NET Framework is not affected. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/494 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.1 - **Vector:** - **Weakness:** CWE-787 (Out-of-bounds Write) ## Affected Platforms - **Platforms:** All - **Architectures:** All ## Mitigations ASP.NET Core request decompression and HttpClient automatic response decompression are not enabled by default. An application is not exposed merely because an affected .NET package is installed. Exposure requires the application to decompress attacker-controlled Brotli data through one of these paths: - Enable ASP.NET Core [automatic request decompression](https://learn.microsoft.com/aspnet/core/fundamentals/middleware/request-decompression) with Brotli ( ) support. - Enable HttpClient automatic response decompression by configuring [HttpClientHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.httpclienthandler.automaticdecompression) or [SocketsHttpHandler.AutomaticDecompression](https://learn.microsoft.com/dotnet/api/system.net.http.socketshttphandler.automaticdecompression) to include [DecompressionMethods.Brotli](https://learn.microsoft.com/dotnet/api/system.net.decompressionmethods) or . - Explicitly use Brotli decompression APIs in , such as or . Until the update can be deployed, avoid decompressing attacker-controlled Brot