Microsoft Issues Out-of-Band .NET Security Updates Fixing Brotli Buffer Overflow and Other Flaws
Microsoft has published out-of-band security updates for the .NET application development platform to address multiple vulnerabilities. The company also completed remediation for issues that received insufficient fixes in the regular October security update.
On October 25, 2026, Microsoft released patches for .NET 10, .NET 9, and .NET 8. The updates resolve two newly discovered vulnerabilities and provide complete fixes for two additional flaws that were only partially addressed on October 13.
The first vulnerability, tracked as CVE-2026-111497, resides in the Brotli data compression library developed by Google. It is a buffer overflow flaw that occurs during decompression of specially crafted data. Successful exploitation can allow unauthenticated attackers to read memory contents, cause denial of service, or escalate privileges. The vulnerability affects applications that use the Brotli API to decompress externally supplied data, as well as ASP.NET Core request decompression and HttpClient response auto-decompression features when enabled. It carries a CVSS v3.1 base score of 8.1 and has been rated Critical by Microsoft. Workarounds include disabling Brotli processing.
The second vulnerability, CVE-2026-114148, affects Linux distribution packages for ASP.NET Core and related components. It stems from improper handling of file ownership information and can allow local attackers to modify files or escalate privileges. The issue is rated Important with a CVSS base score of 7.8.
Microsoft also reissued fixes for two remote code execution vulnerabilities, CVE-2026-70197 and CVE-2026-102870, that were incompletely patched during the regular October update. The company strongly recommends immediate installation of the updates. Applications that embed the runtime or run in container environments must be rebuilt and redistributed after the environment is updated.
Related articles
Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate
Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.
Critical SQL Injection Flaw in Arista VCO Already Exploited in Attacks
Arista Networks disclosed a critical SQL injection vulnerability in its VeloCloud Orchestrator product used for SD-WAN network management. The flaw, tracked as CVE-2026-114625, carries a CVSS v4.0 base score of 9.4 and a CVSS v3.1 score of 9.9, placing it in the highest severity category. Exploitation requires network access to the management interface and an authenticated session with Enterprise Read Only privileges or higher, after which attackers can escalate rights to reach internal management functions and compromise managed systems and data. The vendor has already observed active exploitation of the issue in the wild. Patches are available in versions 6.4.2.12, 6.1.3.10, and 5.2.3.18, and customers are urged to apply the updates immediately.
Researcher Develops Kernel Exploit for TP-Link EAP770 to Disable Faulty Qualcomm SFE Offload
A user who purchased the TP-Link EAP770 v1 Wi-Fi 7 access point in 2023 discovered persistent data corruption during large file transfers over Wi-Fi. The root cause was a DMA cache coherency bug in the Qualcomm qca-nss-dp driver combined with SFE/PPE hardware offload that recalculated TCP checksums on corrupted packets. TP-Link ended support for the v1 model before release and provided no firmware updates, while the device's restricted shell prevented the required sysfs writes. The researcher chained CVE-2022-0185 with pipe buffer manipulation to achieve root access, disable the offload features, and stop the corruption without bricking the device. The exploit was developed and tested first in QEMU using the closest available GPL kernel sources from the EAP783 model before being adapted to the live hardware. A separate unrelated bug was also found in the client Wi-Fi card firmware causing connection drops.
Apple iOS Security Architecture: From Power Button to App Launch in Modern Devices
The article examines the complete boot and trust chain in modern iPhones, starting from the immutable BootROM and progressing through iBoot, the XNU kernel, and the Secure Enclave. It explains how Secure Boot verifies signatures but does not guarantee absence of vulnerabilities, allowing exploits like checkm8 to persist across devices. The piece details data protection classes, BFU versus AFU states, and how passcodes interact with hardware-bound keys to limit brute-force attempts. It further describes application sandboxing, entitlements, code signing, and Pointer Authentication (PAC) as layered defenses that raise the cost of exploitation. The analysis shows why modern jailbreaks require multi-stage chains involving kernel read/write, sandbox escapes, and PAC bypasses rather than single vulnerabilities. Overall, the architecture transforms privilege from a simple scalar into a graph of capabilities across isolated components.