Microsoft ships out-of-band security updates to address a critical Brotli decoder vulnerability reported by OpenAI’s Codex Security team, with fixes released for .NET, Visual Studio, and PowerShell. The flaw involves a memory corruption issue in the Brotli decoder (described as a buffer overflow or out-of-bounds write) and is tracked under CVE-2026-111497, with Microsoft also referencing related identifiers such as Broccoli2Shell / Node2Shell / HTTP2Shell.
The reports say the affected Brotli library is commonly bundled into multiple ecosystems beyond Microsoft, including Node.js, Python packages, and other tools or proxies that incorporate Brotli. Outlets describe the risk as enabling attackers to corrupt memory, access sensitive data, or potentially execute code, and note that emergency patches are being applied across these platforms.
Coverage emphasizes different naming and impacted components. Some outlets foreground Microsoft’s emergency .NET release, while others highlight the broader, cross-platform nature of the Brotli decoder issue affecting Node.js and Python packaging ecosystems, along with the emergency pace and the CVE reference.
