Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too.

In a .NET blog post , Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its security update guide lists the Visual Studio and PowerShell builds.

Microsoft rates the flaw critical for .NET and Visual Studio and important for PowerShell. It lists the flaw as publicly disclosed and not exploited, with exploitation “more likely”.…