WORLD WATCH · October 25, 2026 · EXPOSURE
Brotli decoder buffer overflow
An out-of-bounds write in .NET affects the Brotli decoder under CVE-2026-111497.
- Reported by
- MSRC
- Outlets reporting
- 1
- Category
- EXPOSURE
- Identifiers
- CVE-2026-111497
- Newest report
- October 25, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- CVE-2026-111497 affects the Brotli decoder
- An out-of-bounds write occurs in .NET
- An unauthorized attacker can elevate privileges over a network
- MSRC reports the vulnerability
What happened
The report comes from MSRC.
CVE-2026-111497 affects the Brotli decoder in .NET.
An out-of-bounds write occurs in that decoder.
An unauthorized attacker can use that write over a network.
That action allows privilege elevation for the unauthorized attacker.
Why it matters
Privilege elevation gives an unauthorized attacker higher access than assigned.
That access change can affect a system that uses the Brotli decoder in .NET.
The attack can occur over a network without prior authorization.
What to do
- Check affected .NET systems for CVE-2026-111497.
- Apply a patch for CVE-2026-111497 when available to affected systems.
- Limit network access to systems that use the Brotli decoder in .NET.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 25, 2026). This brief summarizes reporting by MSRC. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.