certfr_avis - certfr-2026-avi-1382

CERTFR-2026-AVI-1382

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer une élévation de privilèges.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	.Net	.NET 10.0 installé sur Windows versions antérieures à 10.0.403
Microsoft	.Net	.NET 10.0 installé sur Linux versions antérieures à 10.0.403
Microsoft	.Net	.NET 11.0 installé sur Windows versions antérieures à 11.0.100-rc.3.26522.148
Microsoft	.Net	.NET 9.0 installé sur Windows versions antérieures à 9.0.320
Microsoft	.Net	.NET 11.0 installé sur Mac OS versions antérieures à 11.0.100-rc.3.26522.148
Microsoft	.Net	.NET 8.0 installé sur Mac OS versions antérieures à 8.0.427
Microsoft	.Net	.NET 9.0 installé sur Linux versions antérieures à 9.0.320
Microsoft	.Net	.NET 11.0 installé sur Mac OS versions antérieures à 11.0.100-rc.3
Microsoft	.Net	ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) versions antérieures à 9.0.22
Microsoft	.Net	.NET 8.0 installé sur Windows versions antérieures à 8.0.427
Microsoft	.Net	.NET 9.0 installé sur Mac OS versions antérieures à 9.0.320
Microsoft	.Net	.NET 8.0 installé sur Linux versions antérieures à 8.0.427
Microsoft	.Net	.NET source-build Linux tarballs (all archive types) versions antérieures à 10.0.403-servicing.26523.112
Microsoft	.Net	.NET 11.0 installé sur Windows versions antérieures à 11.0.100-rc.3
Microsoft	.Net	.NET 11.0 installé sur Linux versions antérieures à 11.0.100-rc.3
Microsoft	.Net	.NET 11.0 installé sur Linux versions antérieures à 11.0.100-rc.3.26522.148
Microsoft	.Net	.NET 10.0 installé sur Mac OS versions antérieures à 10.0.403

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft .Net CVE-2026-114148	2026-10-25	vendor-advisory
Bulletin de sécurité Microsoft .Net CVE-2026-111497	2026-10-25	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": ".NET 10.0 install\u00e9 sur Windows versions ant\u00e9rieures \u00e0 10.0.403",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 10.0 install\u00e9 sur Linux versions ant\u00e9rieures \u00e0 10.0.403",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Windows versions ant\u00e9rieures \u00e0 11.0.100-rc.3.26522.148",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 9.0 install\u00e9 sur Windows versions ant\u00e9rieures \u00e0 9.0.320",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Mac OS versions ant\u00e9rieures \u00e0 11.0.100-rc.3.26522.148",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 8.0 install\u00e9 sur Mac OS versions ant\u00e9rieures \u00e0 8.0.427",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 9.0 install\u00e9 sur Linux versions ant\u00e9rieures \u00e0 9.0.320",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Mac OS versions ant\u00e9rieures \u00e0 11.0.100-rc.3",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) versions ant\u00e9rieures \u00e0 9.0.22",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 8.0 install\u00e9 sur Windows versions ant\u00e9rieures \u00e0 8.0.427",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 9.0 install\u00e9 sur Mac OS versions ant\u00e9rieures \u00e0 9.0.320",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 8.0 install\u00e9 sur Linux versions ant\u00e9rieures \u00e0 8.0.427",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET source-build Linux tarballs (all archive types) versions ant\u00e9rieures \u00e0 10.0.403-servicing.26523.112",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Windows versions ant\u00e9rieures \u00e0 11.0.100-rc.3",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Linux versions ant\u00e9rieures \u00e0 11.0.100-rc.3",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 11.0 install\u00e9 sur Linux versions ant\u00e9rieures \u00e0 11.0.100-rc.3.26522.148",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": ".NET 10.0 install\u00e9 sur Mac OS versions ant\u00e9rieures \u00e0 10.0.403",
      "product": {
        "name": ".Net",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-114148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114148"
    },
    {
      "name": "CVE-2026-111497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
    }
  ],
  "initial_release_date": "2026-10-26T00:00:00",
  "last_revision_date": "2026-10-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1382",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft .Net. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
  "vendor_advisories": [
    {
      "published_at": "2026-10-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft .Net CVE-2026-114148",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148"
    },
    {
      "published_at": "2026-10-25",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft .Net CVE-2026-111497",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497"
    }
  ]
}

CVE-2026-111497 (GCVE-0-2026-111497)

Vulnerability from cvelistv5

Published

2026-10-22 13:35

Modified

2026-10-28 03:55

Severity ?

9.2 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-787 - Out-of-bounds Write
CWE-252 - Unchecked Return Value

Summary

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

References

URL

Tags

	https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high	patch
	https://github.com/andybalholm/brotli/releases/tag/v1.2.7	release-notes, third-party-advisory

Impacted products

	Vendor	Product	Version
	Google	Brotli	Version: 1.0.3 ≤ Version: 1.1.0 ≤ Version: 1.2.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111497",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T03:55:48.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-26T18:10:34.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/advisories/GHSA-9v8h-qqgm-4m35"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/25"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/24/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/12"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/13"
          },
          {
            "url": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"
          },
          {
            "url": "https://broccoli2shell.com"
          },
          {
            "url": "https://github.com/dotnet/announcements/issues/494"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.2.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.1.1"
          },
          {
            "url": "https://github.com/google/brotli/releases/tag/v1.0.10"
          },
          {
            "url": "https://patchtheplanet.org/brotli"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/26/16"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "github.com/google/brotli",
          "product": "Brotli",
          "repo": "https://github.com/google/brotli",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "1.0.10",
              "status": "affected",
              "version": "1.0.3",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.2.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI Codex Security - Khai Tran and Sylvie Mayer"
        }
      ],
      "datePublic": "2026-02-27T07:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA buffer overflow vulnerability in the Brotli decoder (\u003ccode\u003ec/dec/decode.c\u003c/code\u003e) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\u003cbr\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252 Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T14:58:42.704Z",
        "orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
        "shortName": "Google"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
        },
        {
          "tags": [
            "release-notes",
            "third-party-advisory"
          ],
          "url": "https://github.com/andybalholm/brotli/releases/tag/v1.2.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
            }
          ],
          "value": "Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Out-of-Bounds Write in Google Brotli Decoder",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
    "assignerShortName": "Google",
    "cveId": "CVE-2026-111497",
    "datePublished": "2026-10-22T13:35:41.975Z",
    "dateReserved": "2026-10-16T09:58:17.790Z",
    "dateUpdated": "2026-10-28T03:55:48.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2026-AVI-1382

Vulnerability from certfr_avis

Solutions

CVE-2026-111497 (GCVE-0-2026-111497)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature