On Sunday, October 25, Microsoft shipped an unscheduled .NET update. The October 13 security release had not fully closed two earlier flaws, and a new critical one could not wait for the next Patch Tuesday. That new one is CVE-2026-111497, and it reaches the web servers Indicium runs on.
This post explains what the vulnerability is, who needs to act, and what to do for your hosting setup.
What the vulnerability does
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, the library that decompresses Brotli-encoded data. Google Brotli versions 1.0.3 through 1.2.0 are affected. A remote attacker needs no credentials. One crafted compressed stream makes the decoder write past the end of its buffer, which corrupts memory and can lead to remote code execution. Google rates it 9.2 on CVSS 4.0, which is Critical. Public proof-of-concept code exists.
.NET carries its own copy of the decoder, so a library update on the operating system does not close the gap. You need the patched .NET runtime. Microsoft fixed it in .NET 8.0.33, .NET 9.0.22, .NET 10.0.14 and .NET 11 Release Candidate 3.
Is your environment affected?
Indicium runs on .NET, so any server hosting it on an unpatched .NET 8, 9 or 10 runtime is affected.
What you do depends on where Indicium runs:
| Hosting model | What to do |
| Self-hosted on Windows | Run Windows Update on the web servers, or install the patched .NET runtime directly. |
| Self-hosted on Linux | Update the .NET runtime through your package manager. |
| Azure App Service | Restart the app service |
| AWS Elastic Beanstalk | Update the environment to a platform version with the patched .NET runtime, then restart the app server. |
| Google Cloud | On Compute Engine, update the .NET runtime like any self-hosted server. On Cloud Run or GKE, deploy the new Indicium container image. |
| Containers | Pull the new Indicium container image(2026.3.11.1) and redeploy. |
| Thinkwise Cloud | All Indicium containers have been updated to the newest version. |