Critical CVE‑2026‑111497 Brotli Decoder Flaw Triggers Remote Code Execution in .NET Applications
What Happened — Microsoft disclosed a critical‑severity vulnerability (CVE‑2026‑111497, dubbed Broccoli2Shell) in the Brotli compression library used by .NET 8‑11. The flaw is an out‑of‑bounds write in the decoder that allows an unprivileged attacker to send a crafted Brotli stream, causing crashes, memory leaks, or remote code execution. When .NET is configured to use Brotli (e.g., ASP.NET Core request decompression, HttpClient response decompression, or direct System.IO.Compression APIs), the vulnerability can also be leveraged for privilege escalation. Proof‑of‑concept exploits are publicly available, but no active exploitation has been reported. Microsoft issued out‑of‑band patches for .NET 8, 9, 10 and the .NET 11 release candidate, and recommends immediate deployment.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management control that proves timely patching and verification of third‑party components.
Who Is Affected — Software vendors, SaaS providers, and any organization that builds .NET applications that opt‑in to Brotli compression (TECH_SAAS, CLOUD_INFRA, FIN_SERV, etc.).
Recommended Actions
- Deploy the Microsoft out‑of‑band .NET updates for all affected runtimes without delay.
- If patching cannot be performed immediately, block Brotli‑compressed traffic at the perimeter or disable Brotli decoding in the application.
- Conduct an inventory of bundled Brotli libraries to ensure no legacy copies remain unpatched.
- Document the remediation steps as evidence for audit readiness.
Technical Notes
- Attack Vector: Exploitation of a memory‑corruption bug in the Brotli decoder (out‑of‑bounds write).
- CVE: CVE‑2026‑111497, CVSS ≈ 9.8 (critical).
- Impact: Remote code execution, potential privilege escalation on systems running vulnerable .NET configurations.
- Mitigation: Apply OOB patches for .NET 8‑11; block or disable Brotli decoding where patching is not feasible.