vulnerability
.NET ships an out-of-band patch: a Brotli overflow, a tarball ownership flaw, and two fixes that had to be redone
Microsoft's 2026-10-25 out-of-band .NET release fixes a Brotli decompression buffer overflow now on CISA's KEV list, a Linux tarball ownership flaw that lets a local attacker escalate, and two network-code-execution CVEs whose October 13 patch turned out to be incomplete.