CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder

Vulnerability ID: GHSA-P3JP-9V83-76W9
CVSS Score: 8.1
Published: 2026-11-03

CVE-2026-111497 (tracked as GHSA-p3jp-9v83-76w9) is an out-of-bounds heap write vulnerability in the native Google Brotli decompression library bundled within the Microsoft .NET runtime. The flaw occurs during the parsing of malformed block-switch sequences in compressed bitstreams when the fast execution path discards validation return statuses. Unauthenticated attackers delivering crafted Brotli payloads to applications configured to decompress untrusted streams can trigger memory corruption, resulting in denial of service, information disclosure, or arbitrary code execution.

TL;DR

An out-of-bounds heap write (CWE-787) in the native Brotli 1.1.0 decoder bundled with .NET 8, 9, 10, and 11 allows unauthenticated attackers to corrupt process memory via crafted compressed bitstreams when Brotli decompression is enabled.

Technical Details

• Vulnerability ID: CVE-2026-111497 / GHSA-p3jp-9v83-76w9
• Weakness Class: CWE-787 (Out-of-bounds Write) / CWE-120 (Buffer Overflow)
• CVSS v3.1 Score: 8.1 High (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Affected Component: System.IO.Compression.BrotliDecoder / native Brotli decode.c
• Attack Vector: Network (Untrusted Brotli-compressed HTTP streams or payloads)
• Impact: Out-of-bounds heap write leading to DoS, Info Disclosure, or RCE
• Exploit Status: Unproven (No public PoC; not listed in CISA KEV)
• Patched Versions: .NET 8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3 / Brotli 1.1.1

Affected Systems

• Microsoft .NET 8 Runtime and SDK
• Microsoft .NET 9 Runtime and SDK
• Microsoft .NET 10 Runtime and SDK
• Microsoft .NET 11 Preview Runtime and SDK
• Microsoft.DotNet.ILCompiler
• Microsoft.NETCore.App.Runtime.*
• Microsoft.NETCore.App.Runtime.NativeAOT.*
• Microsoft.NETCore.App.Runtime.Mono.*
• Google Brotli (< 1.1.1)
• .NET 8 Runtime: >= 8.0.0, < 8.0.33 (Fixed in: 8.0.33)
• .NET 9 Runtime: >= 9.0.0, < 9.0.22 (Fixed in: 9.0.22)
• .NET 10 Runtime: >= 10.0.0, < 10.0.14 (Fixed in: 10.0.14)
• .NET 11 Preview Runtime: >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 (Fixed in: 11.0.0-rc.3.26522.148)
• Brotli: <= 1.1.0 (Fixed in: 1.1.1)

Code Analysis

Commit: f3d8b2f

Update Brotli to 1.1.1 (#136471) - Introduces BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and BROTLI_SAFE_WITH_STATUS macro to enforce block-switch status validation in both safe and unsafe decoding paths.

--- a/src/native/external/brotli/c/include/brotli/decode.h
+++ b/src/native/external/brotli/c/include/brotli/decode.h
@@ -1,3 +1,3 @@
-  /* -17 code is reserved */                                               \
+  BROTLI_ERROR_CODE(_ERROR_FORMAT_, BLOCK_SWITCH, -17) SEPARATOR           \
--- a/src/native/external/brotli/c/dec/decode.c
+++ b/src/native/external/brotli/c/dec/decode.c
@@ -1,15 +1,15 @@
-static BROTLI_INLINE BROTLI_BOOL DecodeBlockTypeAndLength(
+static BROTLI_INLINE BrotliDecoderErrorCode DecodeBlockTypeAndLength(
     int safe, BrotliDecoderState* s, int tree_type) {
   brotli_reg_t max_block_type = s->num_block_types[tree_type];
   if (max_block_type <= 1) {
-    return BROTLI_FALSE;
+    return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH;
   }

Mitigation Strategies

• Upgrade host .NET runtimes and SDKs to patched versions incorporating Google Brotli 1.1.1.
• Recompile and redeploy self-contained and NativeAOT applications against patched runtime packs.
• Disable the Brotli ('br') decompression provider in ASP.NET Core RequestDecompressionOptions if patching cannot be performed immediately.
• Restrict HttpClientHandler and SocketsHttpHandler AutomaticDecompression settings to GZip and Deflate only.
• Block or strip 'Content-Encoding: br' HTTP headers at the reverse proxy, API gateway, or WAF layer for incoming client requests.

Remediation Steps:

1. Inventory all deployed .NET 8, .NET 9, .NET 10, and .NET 11 Preview services and client applications.
2. Update .NET 8 environments to Runtime 8.0.33 (SDK 8.0.133 or 8.0.427).
3. Update .NET 9 environments to Runtime 9.0.22 (SDK 9.0.123 or 9.0.320).
4. Update .NET 10 environments to Runtime 10.0.14 (SDK 10.0.114 or 10.0.403).
5. Update .NET 11 Preview environments to Runtime/SDK 11.0.0-rc.3.26522.148.
6. Rebuild and redeploy any self-contained deployments or NativeAOT binaries referencing Microsoft.DotNet.ILCompiler or Microsoft.NETCore.App.Runtime.*
7. Restart all framework-dependent .NET host processes, systemd services, containers, and IIS application pools.

References

• GitHub Advisory Database: GHSA-p3jp-9v83-76w9
• dotnet/runtime Repository Security Advisory: GHSA-p3jp-9v83-76w9
• Microsoft Security Advisory: CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
• dotnet/runtime Tracking Issue #136446
• dotnet/runtime Fix Pull Request #136471
• dotnet/runtime Fix Commit f3d8b2f230bc7c9899df6eef2d41e2748107cffa
• CVE.org Record: CVE-2026-111497
• Official Microsoft .NET Downloads
• MITRE CWE-787: Out-of-bounds Write
• MITRE CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Read the full report for GHSA-P3JP-9V83-76W9 on our website for more details including interactive diagrams and full exploit analysis.