Microsoft and Security Agencies Urge Immediate Patches for Flaw in Brotli Algorithm

Microsoft has rolled out emergency out-of-band security updates across Windows, macOS, and Linux platforms to remediate a critical vulnerability in the Google-developed Brotli compression algorithm. The flaw, tracked as CVE-2026-111497, poses severe risks to web applications, servers, and runtime environments that decode Brotli-compressed streams. Security officials and software developers worldwide have warned that malicious actors can exploit the defect to execute arbitrary code, steal process memory, and crash services.

Originally developed by Google in 2015 to compress text, images, and code efficiently, Brotli functions by substituting commonly used terms and repetitive patterns with shorthand dictionary references. The newly discovered vulnerability—classified as a buffer overflow stemming from unchecked return values during decompression—was initially identified on October 22. In a public announcement on October 25, Rahul Bhandari, a senior program manager for Microsoft .NET, explained that the flaw permits an unauthenticated attacker to corrupt or read process memory remotely without credentials.

While initial attention centered on Microsoft .NET, security researchers and advisory bodies quickly determined that the vulnerability extends across multiple platforms utilizing the Brotli decoder. In security circles, the flaw has earned nicknames such as "Broccoli2Shell," "Node2Shell," and "HTTP2Shell" due to its reach into tools like Node.js, PHP, and Palo Alto Networks products. Google Brotli versions ranging from 1.0.3 through 1.2.0 are vulnerable, prompting upstream releases of patched versions 1.0.10, 1.1.1, and 1.2.1.

Discrepancies have emerged regarding the operational status of attacks in the wild. While the Microsoft Security Response Center initially stated there was no direct evidence of exploitation—listing it merely as "more likely"—the Cybersecurity and Infrastructure Security Agency added the Brotli flaw to its Known Exploited Vulnerabilities catalog. The Hong Kong Computer Emergency Response Team Coordination Centre also reported active in-the-wild exploitation. Concurrently, cybersecurity researchers confirmed that proof-of-concept code demonstrating remote code execution had become publicly accessible, with attempted targeting observed against Node.js installations.

Within Microsoft's ecosystem, the vulnerability directly impacts .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3, while legacy .NET Framework installations remain unaffected. Applications become susceptible when handling Brotli-compressed data through System.IO.Compression APIs, ASP.NET Core request decompression, or automatic response decompression in HttpClient. Microsoft noted that automated request and response decompression settings are turned off by default, narrowing direct exposure to configurations actively decoding incoming client data.

The out-of-band release also incorporated remedies for a secondary Linux issue, CVE-2026-114148, which involved unsafe file ownership permissions in source-build tarballs that could allow local privilege escalation. Additionally, Microsoft used the emergency deployment to reissue updated patches for CVE-2026-70197, a memory corruption flaw in SocketAsyncEventArgs, and CVE-2026-102870, an issue in the Blazor WebAssembly debugger. Both flaws had remained incompletely resolved following Microsoft’s standard October 13 Patch Tuesday releases, which had addressed a record 1,413 vulnerabilities.

Industry experts emphasized that applying the fixes requires meticulous deployment across varied system architectures. Seemant Sehgal, founder and CEO of BreachLock, warned that unpatched Brotli implementations could allow attackers to establish memory corruption and escalate privileges to service accounts that frequently hold excessive enterprise reach. Administrators must update shared runtime environments to .NET versions 8.0.33, 9.0.22, or 10.0.14, while developers running self-contained applications and container images must rebuild and republish their packages, as host-level updates do not patch embedded runtimes.