Microsoft released out-of-band security updates on October 25 for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. The releases address CVE-2026-111497 in Brotli decompression. Microsoft says request and automatic response decompression are not enabled by default; .NET Framework is unaffected.
The listed releases are 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3. Microsoft distinguishes applications using a host runtime from self-contained applications that require rebuilding and republishing, and containers that require rebuilding and redeployment. The package also includes other fixes, including corrections to two issues not fully addressed on October 13.
Implications — NAOAT analysis
The practical challenge is finding the software that will actually execute after maintenance. A server inventory can establish where a runtime is installed, but the deployment model determines what that observation means. Security teams and application owners should agree on the evidence required before closing an update task.
One useful approach is to organize the work by deployed application, with a named owner and a record of how the release was produced. That record can connect the source revision, build inputs, deployment artifact and running service. It gives reviewers a concrete chain to examine instead of relying on an assurance that the machine was updated.
Validation should include the application’s ordinary data flows and any relevant decompression settings. A configuration review helps identify exposure, while a targeted functional check can reveal whether the repaired deployment still handles legitimate inputs as expected. Neither check should be treated as evidence that an earlier intrusion did or did not occur.
For organizations distributing software to customers, the handoff also matters. A corrected internal build needs a delivery path, a clear release identifier and confirmation that users have received it. Packaging and distribution are therefore part of the security response, not administrative steps left until after the engineering work is considered complete.