.NET out-of-band update (CVE-2026-70197, CVE-2026-102870, CVE-2026-114148): the 13 October fixes were incomplete

What happened

On 25 October 2026, Microsoft shipped out-of-band security updates for .NET 8, 9 and 10 and .NET 11 Release Candidate 3 (.NET Blog). The release does three things.

It re-fixes two October bugs. The 13 October release “did not fully address” two flaws, so Microsoft re-released them (.NET Blog):

• CVE-2026-70197, an out-of-bounds write in .NET that lets an unauthenticated attacker run code over a network. CVSS 8.1. The blog lists it as SocketAsyncEventArgs memory corruption, for .NET 8, 9, 10 and 11 (CVE record; .NET Blog).
• CVE-2026-102870, a code injection flaw in ASP.NET Core rated CVSS 8.8 that needs user interaction. The blog lists it as a Blazor WebAssembly debugger issue, for .NET 10 and 11 (CVE record).

It adds a new Linux fix. CVE-2026-114148 (CVSS 7.8) is unsafe ownership metadata in .NET tarballs. A local attacker could modify files and gain higher privileges. For .NET 10 and 11 only source-build tarballs are affected. For .NET 8 and 9, Microsoft’s ASP.NET Core tarballs are affected too, even if you never build from source (.NET Blog; CVE record).

It carries the Brotli fix. CVE-2026-111497 is the buffer overflow in Google’s Brotli decoder. .NET apps are exposed if they decompress Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. The first two are off by default. .NET Framework is not affected (.NET Blog). CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a federal due date of 10 November (CISA KEV). Our Node.js advisory covers that bug in detail.

Microsoft’s post does not report exploitation of the other three. CISA’s enrichment of the CVE records for CVE-2026-70197, CVE-2026-102870 and CVE-2026-114148 lists exploitation as “none” (CVE-2026-70197; CVE-2026-114148).

Am I affected?

Any .NET 8, 9 or 10 runtime older than 8.0.33, 9.0.22 or 10.0.14 is affected, including hosts patched on 13 October. Check each machine and each image:

# Runtimes installed on a host (framework-dependent apps use these)
dotnet --list-runtimes

# Inside a container image
docker run --rm --entrypoint dotnet <image> --list-runtimes

Self-contained apps do not use the host runtime. For those, check the runtime pack version recorded in the app’s <app>.deps.json (search it for runtimepack), or simply rebuild.

For CVE-2026-114148, you are affected on Linux if you installed .NET 8 or 9 from Microsoft’s ASP.NET Core runtime tarball, or if you consume .NET source-build tarballs (for example, a distribution or internal build that packages .NET from source).

For the Brotli bug, search your code for the features the blog names:

grep -rnE 'AddRequestDecompression|AutomaticDecompression|BrotliStream|BrotliDecoder' --include='*.cs' .

What to do now

1. Install the 25 October runtimes: .NET 8.0.33, 9.0.22 or 10.0.14. Move .NET 11 RC2 to RC3. Restart framework-dependent apps and confirm with dotnet --list-runtimes (.NET Blog).
2. Rebuild and republish self-contained apps with the updated SDK. Updating the host runtime does not touch the runtime bundled inside the app.
3. Rebuild container images from updated .NET base images and redeploy. Microsoft says container deployments must be checked separately because they carry their own runtime.
4. ASP.NET Core tarball users on .NET 8 and 9: replace the install with the refreshed ASP.NET Core Runtime tarball for your version. Source-build consumers need the updated source-build artifacts and a rebuild of their packages.
5. If you cannot patch today and use Brotli decompression, check whether request decompression or HttpClient automatic decompression is enabled on internet-facing services. Microsoft offers no workaround beyond updating.

Sources

• .NET Blog: .NET October 2026 out-of-band security updates
• CVE record: CVE-2026-70197
• CVE record: CVE-2026-102870
• CVE record: CVE-2026-114148
• CISA Known Exploited Vulnerabilities catalog