Microsoft shipped out-of-band updates on Sunday to address a critical security issue impacting .NET, Visual Studio, and PowerShell. According to The Next Web, the emergency patch fixes a buffer overflow in the Brotli compression library that was originally discovered by OpenAI's Codex Security team.
Key takeaways
- Microsoft rolled out emergency updates for .NET, Visual Studio, and PowerShell on Sunday.
- The patches fix CVE-2026-111497, a buffer overflow in Google's Brotli compression library.
- OpenAI's Codex Security team reported the flaw, which is also known by names like Node2Shell.
- Cloud security firm Wiz estimates that 91 percent of cloud environments hold vulnerable resources.
What does the microsoft NET emergency patch fix?
The updates resolve CVE-2026-111497, a buffer overflow located in Google's widely used compression library, Brotli. The Next Web reports that Microsoft warned this memory issue could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege. The advisory covers .NET versions 8, 9, 10, and .NET 11 Release Candidate 3, alongside specific builds of Visual Studio and PowerShell.
Microsoft rates the bug as critical for .NET and Visual Studio, and important for PowerShell. While the flaw is publicly disclosed and exploitation is considered more likely, officials note that it has not been actively exploited yet and that .NET does not switch on Brotli decompression by default.
How widespread is the Brotli vulnerability?
The security bug, which also goes by the names Node2Shell, HTTP2Shell, and Broccoli2Shell, originates in the C decoder of Brotli versions 1.0.3 through 1.2.0. Because many software packages bundle this decoder directly into their own code, Node.js, Python packages, proxies, Bun, Envoy, Istio, and other tools are shipping their own fixes. Google assigned the CVE a severity score of 9.2 out of 10.
Cloud security firm Wiz reports that 91 percent of cloud environments contain resources vulnerable to the bug, with 82 percent hosting publicly exposed Node.js instances. JFrog has also spotted the issue in FFmpeg, ClickHouse, and Apache Arrow, while public trackers indicate that DuckDB, 7-Zip-zstd, p7zip, and EDK II remain unpatched.
Why it matters
Development teams cannot rely on system-level updates alone because many applications bundle their own private copy of the Brotli library. The Next Web points out that after applying the necessary updates, engineers must restart active services and rebuild container images to clear out old code remaining in running processes. Researchers note that an attack requires an application to process malicious compressed data, such as a crafted server response or request.
Frequently asked questions
Microsoft shipped out-of-band updates for .NET versions 8, 9, 10, and .NET 11 Release Candidate 3, as well as specific builds of Visual Studio and PowerShell.
The flaw was discovered by Khai Tran and Sylvie Mayer of OpenAI's Codex Security team during red-teaming work.
Google assigned the CVE a severity score of 9.2 out of 10. Microsoft rates the vulnerability as critical for .NET and Visual Studio, and important for PowerShell.
No attacks using the flaw have been reported, although Microsoft lists exploitation as more likely since the issue is publicly disclosed.
Running processes keep the old code in memory, and updating a system library does not automatically fix applications that bundle their own private copy of Brotli.
Based on reporting by The Next Web. Read the original article
