.NET and PowerShell: check your installations against two new Microsoft records

One remote flaw, one local privilege escalation

In Microsoft’s October security document, the first revisions for CVE-2026-111497 and CVE-2026-114148 are dated 25 October. Both require customer action. These are not changes to the Exchange record alone: they concern other components to inventory.

CVE-2026-111497 affects the Brotli decoder, a decompression library used by .NET. Microsoft describes an out-of-bounds write allowing an unauthorized attacker to elevate privileges over a network. For the Brotli library, NVD describes a malicious compressed stream that can corrupt memory or cause a denial of service, among other effects. SecuFocus has not reproduced either description as an attack.

CVE-2026-114148 has a different condition: incorrect default permissions in ASP.NET Core allow an already authorized attacker to elevate privileges locally. Microsoft’s FAQ describes gaining the highest system privileges. This record has no CVSS score. Microsoft marks Exploited as No for both identifiers. The vendor’s assessment does not guarantee that no attack exists.

• Keep these fixes separate from the Exchange flaw↗

Match the fix to the .NET package

For the listed .NET installations on Windows, Linux and Mac OS, both records give the builds below. These values come from Microsoft’s FixedBuild field; we have not downloaded the updates. If an application bundles its own environment, follow its vendor’s update rather than manually replacing an internal library.

The .NET 11 line remains a prerelease. The two records do not write its build number in the same way, so their exact values are preserved here. Do not turn them into one common stable version.

Scroll the table sideways to read every column.

Two Linux archive types have separate build numbers

For CVE-2026-114148, Microsoft also distinguishes Microsoft-published ASP.NET Core runtime and targeting-pack Linux tarballs, listing build 9.0.22. The .NET source-build Linux tarballs have another entry: 10.0.403-servicing.26523.112. Those numbers do not replace the table’s values for every product.

Before updating, identify the package, its source and the environment actually running the service. Prepare a rollback. After the update and required restart, check the version again and verify the application works. This maintenance sequence is our recommendation, not a test of those packages.

PowerShell and Visual Studio are also listed for Brotli

The CVE-2026-111497 record lists PowerShell 7.4.22 for the 7.4 branch, 7.5.13 for 7.5 and 7.6.9 for 7.6. If you use one of those branches, follow its usual update channel, then read the version of the program you actually launch. Do not assume a Windows update has replaced every installed copy.

Microsoft also lists Visual Studio fixes. Consult the record for your edition rather than applying a PowerShell number to the IDE. SecuFocus has neither installed these builds nor tested exploitation.

• See the same installed-engine versus running-service distinction for Node.js↗