Microsoft releases emergency .NET patches for critical Brotli flaw

Microsoft released emergency .NET security updates to fix the critical vulnerability CVE-2026-111497. The flaw affects the Brotli decoder and may allow a maliciously crafted Brotli-compressed stream to cause crashes or memory leaks and, in some cases, achieve remote code execution on a device. No reports of exploitation in the wild have emerged, although proof-of-concept exploits have been published on GitHub.