{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000a1a0fa0e","releaseDate":"2026-10-25T07:00:00-07:00","cveNumber":"CVE-2026-111497","cveTitle":"Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-26T07:00:00-07:00","description":"<p>Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.</p>\n","cweList":[],"cweDetailsListForSearch":[],"unformattedDescription":"<p>Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.</p>","mitreText":"CVE-2026-111497","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111497","publiclyDisclosed":"Yes","exploited":"No","latestSoftwareReleaseId":1,"latestSoftwareRelease":"Exploitation More Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":".NET","issuingCna":"Google","issuingCnaId":100000002,"severityId":100000000,"severity":"Critical","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"8.1","temporalScore":"7.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[],"articles":[{"title":".NET Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.</p>\n","ordinal":10000},{"articleType":"Mitigation","description":"<p>Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Why is this third-party CVE included in the Security Update Guide?</strong></p>\n<p>This CVE concerns a vulnerability in the Brotli library used by .NET. See the <a href=\"https://www.cve.org/CVERecord?id=CVE-2026-111497\">Google security advisory</a> for information about the upstream vulnerability. For background on how Microsoft documents partner-assigned CVEs, see <a href=\"https://msrc-blog.microsoft.com/2021/01/13/security-update-guide-supports-cves-assigned-by-industry-partners/\">Security Update Guide Supports CVEs Assigned by Industry Partners</a>.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-111497","version":1,"revisionDate":"2026-10-25T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":true,"notificationSent":true,"sourceId":"543791cc-7ece-f111-a059-000d3a369ea6"},{"cveNumber":"CVE-2026-111497","version":1.1,"revisionDate":"2026-10-26T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Acknowledgement Updated</p>\n","unformattedDescription":"Acknowledgement Updated","notificationNeeded":false,"notificationSent":false,"sourceId":"3099955b-dfd0-f111-a059-7ced8d6f06f2"}]}