Microsoft has released emergency out-of-band updates for .NET to fix a critical flaw in the way it unpacks Brotli-compressed data. Public proof-of-concept exploit code is available.

• What it is: An out-of-bounds write flaw (CVE-2026-111497, also called Broccoli2Shell) that a crafted web request can trigger, causing crashes, memory leaks or, in some cases, remote code execution.
• Who is affected: Business applications and websites built on .NET 8, 9, 10 or 11 that process Brotli data. Brotli is not enabled by default, so exposure depends on how each application is set up.
• The risk: No malicious use has been confirmed yet, but public exploit code makes attacks likely.
• Fixed versions: .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 Release Candidate 3.
• If you cannot patch yet: Block Brotli-compressed requests at your firewall or proxy, or disable Brotli decoding.

We recommend asking your software vendor or developer whether your line-of-business applications use .NET, and applying the update promptly. Source: BleepingComputer.