Microsoft re-fixes two .NET flaws its October 13 patches missed; Blazor needs package updates

Timing: Microsoft shipped these out-of-band updates on 25 October 2026. Two of the flaws were first disclosed on 13 October 2026.

What happened

On 25 October, Microsoft released out-of-band .NET updates: 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3. It recommends updating as soon as possible.

Two of the fixes are do-overs. Microsoft says its 13 October release "did not fully address" CVE-2026-102870 and CVE-2026-70197. It re-released both advisories under the same CVE ids.

The release also fixes CVE-2026-111497, the Brotli decoder flaw we covered as Brotli2Shell in .NET, FFmpeg, ClickHouse and Arrow. And it fixes a new Linux tarball bug, CVE-2026-114148.

The four CVEs

CVE-2026-102870, Blazor debugger RCE. The Blazor WebAssembly debug proxy builds C# source to evaluate expressions. Some values from the debugged app go in without consistent escaping. A hostile value can break out of a string and run code on the developer's machine. It needs the developer to evaluate an expression. Microsoft: CVSS 3.1 8.8 (High).

CVE-2026-70197, Windows sockets. Reusing one SocketAsyncEventArgs object across IPv4 and IPv6 datagram sockets can leave an undersized buffer. ReceiveFromAsync can then write out of bounds. Windows only. Microsoft: CVSS 3.1 8.1 (High), high attack complexity.

CVE-2026-111497, Brotli. An out-of-bounds write when .NET decompresses untrusted Brotli data. Microsoft scores its .NET exposure CVSS 3.1 8.1.

CVE-2026-114148, Linux tarballs. Unsafe file ownership in some Linux tarballs can allow local privilege escalation. Microsoft: CVSS 3.1 7.8 (High).

What the October 13 patches missed

CVE-2026-70197: Microsoft says the fix "was not included" in the 13 October updates. So .NET 8.0.32, 9.0.21, 10.0.13 and 11.0 RC2 are still affected. On 19 October, MSRC said the flaw was not addressed and a complete fix was in testing.

CVE-2026-102870: the first advisory named only the Components.WebAssembly.Server package, fixed in 10.0.13. The revision adds Components.WebAssembly.DevServer, which bundles the same debugger. The fix moves to 10.0.14 and 11.0 RC3. Microsoft calls it "corrected .NET 10 and .NET 11 debugger packages and versions". It does not describe the code change.

Why a runtime update is not enough for Blazor

The debugger does not live in the shared runtime. It ships inside two Microsoft.AspNetCore NuGet packages that a project references directly.

Microsoft is explicit: "Updating only the shared runtime is not a substitute." A machine can run .NET 10.0.14 and still debug with a 10.0.13 package. You must bump the package references.

Who is affected

• Blazor WebAssembly developers on .NET 10 or 11 previews who use the Server or DevServer package to debug. .NET 8 and 9 are not listed.
• Windows apps on .NET 8, 9, 10 or 11 that reuse SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets.
• Apps that decompress untrusted Brotli data, on all platforms. Request and response decompression are off by default.
• Linux installs from .NET 8 or 9 ASP.NET Core runtime or targeting-pack tarballs, and source-built .NET 8 to 11. Only when extraction kept the archive's ownership.

.NET Framework is not affected, per Microsoft.

What is confirmed

All facts above come from Microsoft's advisories, the .NET release notes and MSRC, checked on 26 October. MSRC marks none of the four as exploited. It marks CVE-2026-102870, CVE-2026-70197 and CVE-2026-114148 as not publicly disclosed.

None of the four is in CISA KEV (catalog 2026.10.23, checked 26 October). Microsoft credits alittleston3 for the Blazor flaw and Alen Cheung for the tarball flaw. Several researchers are credited for the sockets flaw.

What is not confirmed

We found no public proof of concept for CVE-2026-102870, CVE-2026-70197 or CVE-2026-114148. We found no report of attacks. Microsoft does not explain what exactly was incomplete in the code of the first fixes.

Some records lag. The global GitHub Advisory Database still lists 10.0.13 as fixed for the Blazor flaw and omits DevServer. NVD has not analysed either re-released CVE. On 26 October, CVE-2026-114148 had no CVE.org record and no NVD entry.

What to do

1. Blazor projects. Update both debugger packages to 10.0.14 on .NET 10, or 11.0.0-rc.3.26522.148 on .NET 11. Then restart the debugger and your IDE.
2. Runtime and SDK. Install .NET 8.0.33, 9.0.22, 10.0.14 or 11.0 RC3. Restart framework-dependent apps.
3. Self-contained apps and containers. Rebuild and redeploy. A newer host runtime does not update a bundled one.
4. Linux tarball installs. Install the patched tarball into a new, empty directory without keeping its ownership. Extracting over the old tree does not fix it. Rebuild custom images.
5. If you patched on 13 October, do not assume you are covered. Check versions again.

General hygiene (not from the advisory): treat debugging as running code. Avoid evaluating expressions on untrusted data with an unpatched debugger. Keep secrets and signing keys off machines used to debug untrusted inputs.

Sources

• .NET October 2026 out-of-band security updates
• .NET out-of-band rollup, announcement 496
• Advisory GHSA-g27p-qf6j-c96c (CVE-2026-102870)
• Advisory GHSA-4mpw-cpwj-hxxj (CVE-2026-70197)
• Advisory GHSA-r6pf-x897-gm86 (CVE-2026-114148)
• .NET announcement 494 (CVE-2026-111497)
• .NET 10.0.14 release notes
• MSRC CVE-2026-102870
• MSRC CVE-2026-70197
• MSRC CVE-2026-114148
• NVD CVE-2026-102870
• NVD CVE-2026-70197
• CISA KEV catalog