Microsoft issues emergency .NET patches for critical Brotli flaw ‘Broccoli2Shell’
Vulnerability could allow remote code execution; no active exploitation reported yet
Microsoft has released out-of-band security updates for .NET to address a critical vulnerability in the Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Broccoli2Shell. The flaw, discovered by Imperva Red Team, could allow unprivileged attackers to execute arbitrary code on systems processing maliciously crafted Brotli-compressed data.