[Breaking News] .NET 8, 9, 10 Emergency Update

This article is brought to you by Nabekin Factory, a seller of used computers and office equipment on Rakuten Ichiba.

Many of you are likely thinking, “I just updated on October 13th, and now this?”

In short, if you are using .NET 8, 9, or 10, you need to verify if the patched version is installed, even if you completed the update on October 13th. If the patched version is already installed, you do not need to update again.

Microsoft released an out-of-band security update on October 25, 2026. The patched versions are 8.0.33 / 9.0.22 / 10.0.14.

This article summarizes whether your environment is affected and what you need to do right now.

What happened? The October 25 .NET out-of-band update

On October 25, 2026, Microsoft released an out-of-band (an emergency update released outside of the monthly cycle) security update for .NET 8, 9, and 10 and recommends applying it as soon as possible.

Official Announcement: .NET October 2026 Out-of-Band Security Updates
https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/

The main contents are as follows.

• CVE-2026-111497: A buffer overflow in the part of .NET that decompresses Brotli (a type of compressed data format). An unauthenticated attacker could potentially cause information disclosure, denial of service, or privilege escalation. The CVSS (severity score) on the official GitHub is 8.1, and the severity is “High”.

• CVE-2026-70197: An issue with System.Net.Sockets in Windows. If SocketAsyncEventArgs is reused between IPv4 and IPv6 datagram sockets, an out-of-bounds write can occur in ReceiveFromAsync. Although it was announced on October 13th, the update at that time did not include a fix.

• CVE-2026-102870: An issue with the Blazor WebAssembly debugger. This was also not fully addressed in the October 13th update.

• CVE-2026-114148: An issue regarding file ownership in tarballs (compressed distribution files) for Linux.

Note that the Japanese news site Security NEXT reports the Brotli vulnerability as “Critical.” The evaluation system may differ from the “High” rating on the official GitHub.

Am I affected? How to tell

If your runtime is older than the patched version, an update is required.

Checking your .NET version

Run the following command in the terminal (the screen where you type commands) on your server or development PC.

dotnet –list-runtimesdotnet –list-sdksScreen showing the execution results of dotnet –list-runtimes

If your runtime is older than 8.0.33, 9.0.22, or 10.0.14, it is affected.

If the command is not found, it may simply not be in your PATH (the location where commands are registered). In that case, please check the official verification method.

Microsoft Learn: How to check installed .NET versions
https://learn.microsoft.com/ja-jp/dotnet/core/install/how-to-detect-installed-versions

Usage patterns susceptible to the Brotli vulnerability

The impact occurs when an application decompresses Brotli-compressed data prepared by an attacker.

ASP.NET Core request decompression and HttpClient automatic response decompression are disabled by default. Also, check if you are using BrotliStream or BrotliDecoder directly.

By the way, .NET Framework (the older, separate .NET line) is not affected by this vulnerability.

What to do now

The post-update process depends on how your app is built

1. Install the patched runtime or SDK for the version series you are using (for SDKs installed via Visual Studio, simply update Visual Studio)

2. Apply the update according to your app’s build method

• Framework-dependent (apps using .NET installed on the PC): Restart the app after updating

• Self-contained (apps bundled with .NET): Rebuild and republish with the updated runtime

• Container: Rebuild and redeploy with the updated .NET container image

• NativeAOT: Update the SDK and references to the patched versions and republish. Simply updating the .NET on your PC will not fix it

1. After updating, verify that the patched version is installed for framework-dependent apps using ‘dotnet –list-runtimes’. For self-contained and containerized apps, check the bundled runtime separately

Note that SDK version numbers differ from runtime versions

The update SDK version numbers are 8.0.133/8.0.427 for 8, 9.0.123/9.0.320 for 9, and 10.0.114/10.0.403 for 10.

Also check with your development contractors

The Blazor WebAssembly packages (Microsoft.AspNetCore.Components.WebAssembly.Server/DevServer) will not change even if you update the runtime. You must change the reference to the patched version (10.0.14 for .NET 10) and restart the debugger and development environment.

Whether environments installed from tarballs on Linux are affected is not uniform. .NET 8 and 9 are affected if using the Microsoft-distributed ASP.NET Core runtime/targeting-pack tarballs and the corresponding source-builds, while .NET 10 and 11 are affected if using source-builds. Not all standard .NET runtime/SDK tarballs are affected. For affected environments, simply overwriting the current folder will not fix it. You must reinstall following the official repair procedure (extracting to a new empty folder with –no-same-owner).

Repair procedure for CVE-2026-114148
https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r6pf-x897-gm86

What is not yet known

How to follow up on further reports

It is recommended to bookmark the official update announcement.

.NET October 2026 out-of-band security updates #10660
https://github.com/dotnet/core/issues/10660

Frequently Asked Questions

Q. I updated on October 13, so I have a work record. Is that okay?

A. You cannot tell if this fix was applied just from the record. Please check the version.

Q. Is it okay to just change the setting to stop Brotli decompression?

A. The official recommendation is to apply the security update. If you change settings, you must verify operation, and be careful not to copy workaround code that might re-enable the decompression feature.

Q. Is it okay to keep using .NET 8 and 9 as they are?

A. According to the official support table, both 8 and 9 will reach end of support on November 10, 2026. Along with this update, you should also check your migration plan to 10 (supported until November 14, 2028).

Bonus: Introduction to Nabekin Factory

If you need to purchase additional test PCs to verify updates, or replace old terminals that are difficult to update, please check out Nabekin Factory on Rakuten Ichiba. Used PCs come with a 1-year warranty, and some models have been upgraded with new SSDs.

https://www.rakuten.ne.jp/gold/nabekin/

#dotNET

#SecurityUpdate

#Vulnerability

#SME_IT

#NabekinFactory