TL;DR Microsoft has released an out-of-band .NET security update for .NET 8, 9 and 10, plus .NET 11 Release Candidate 3. It fixes CVE-2026-111497, a Brotli decompression buffer overflow, and CVE-2026-114148, a Linux tarball ownership flaw. The release also completes fixes for two October 13 bugs that were not fully patched. Why It Matters .NET runs a huge range of web apps, APIs and services.