This blog post was created with the help of AI tools. Yes, I used a bit of magic from language models to organize my thoughts and automate the boring parts, but the geeky fun and the in C# are 100% mine.

Hi!

Apple Silicon users, please try this C# sample and let us know whether speech generation and playback work on your Mac!

ElBruno.Speech 1.6.0-preview.5 keeps setup simple: call services.AddOllamaSpeech() for Microsoft.Extensions.AI.ITextToSpeechClient. It defaults to local Ollama and the phonon model. Let’s turn a sentence into a WAV file, with local inference handled by Ollama.

Conceptual flow, not a recording of generated audio. Image generated with AI.

1. Get ready

Use .NET 8 or 10 and a supported Apple Silicon Mac running Ollama with MLX. Ollama’s speech announcement recommends version 0.40.11 or later.

ollama pull phonon
dotnet new console -n HelloPhonon -f net10.0
cd HelloPhonon
dotnet add package ElBruno.Speech.Tts.Ollama --version 1.6.0-preview.5
dotnet add package ElBruno.Speech.Audio --version 1.6.0-preview.5
dotnet add package Microsoft.Extensions.DependencyInjection --version 10.0.13

For .NET 8, replace net10.0 with net8.0. Make sure Ollama is running.

Windows friends: the C# client can call a supported remote Mac, but local Ollama speech currently requires MLX. Windows/Linux server support is pending upstream, with no promised date.

2. Replace Program.cs

The MEAI speech API is experimental. The pragma below explicitly opts into it for this preview.

#pragma warning disable MEAI001
using ElBruno.Speech;
using ElBruno.Speech.Audio;
using ElBruno.Speech.Tts.Ollama;
using Microsoft.Extensions.AI;
using Microsoft.Extensions.DependencyInjection;
var services = new ServiceCollection();
services.AddOllamaSpeech();
using var provider = services.BuildServiceProvider();
var speech = provider.GetRequiredService<ITextToSpeechClient>();
using var pcm = new MemoryStream();
await foreach (var update in speech.GetStreamingAudioAsync(
    "Hello from C sharp! My app has a voice thanks to Ollama Phonon.",
    new TextToSpeechOptions { AudioFormat = "pcm" }))
{
    foreach (var audio in update.Contents.OfType<DataContent>())
        await pcm.WriteAsync(audio.Data);
}
byte[] samples = pcm.ToArray();
if (samples.Length == 0 || samples.Length % 2 != 0)
    throw new InvalidDataException("Expected complete PCM16 audio samples.");
WavWriter.Write("hello.wav",
    new AudioFormat(24000, 1, AudioSampleFormat.Int16), samples);
Console.WriteLine($"Saved: {Path.GetFullPath("hello.wav")}");

Run it:

dotnet run

On a supported Mac, listen with:

afplay hello.wav

The client receives PCM chunks incrementally. This short example buffers them, then writes a WAV with the final sizes: 24 kHz, mono, signed 16-bit PCM. It does not play audio while streaming.

No configuration is required for local Ollama: the defaults are http://localhost:11434/, model phonon, the model’s default voice, and WAV output. This example requests PCM per call for streaming. Using a remote Mac? Replace the registration with services.AddOllamaSpeech(new OllamaSpeechOptions { Endpoint = new Uri("http://YOUR-MAC:11434/") });. The library resolves the speech route automatically. Keep that server on a trusted network; this example does not configure authentication or expose it.

3. Try the complete demo

The full C# sample also saves complete WAV and streamed PCM/WAV files, validates their format, rejects silent output, and supports optional playback.

Honest status: 49 synthetic provider/sample test cases pass on each of .NET 8 and .NET 10, including no-options registration, default request values, and URL normalization for complete and streaming requests. My Windows host could not load Phonon because MLX was unavailable, so I have not generated or listened to real Phonon speech yet. Automated checks are not proof of pronunciation or sound quality.

Community testing invitation, not proof of working audio. Image generated with AI.

If you test it, share your Mac chip, macOS and Ollama versions, whether hello.wav plays, and how it sounds in issue #106. Please include any error message, but no secrets or private audio.

NuGet package | Release notes | Ollama speech docs

You can build .NET 11.0 RC 3 from the repository by cloning the release tag v11.0.100-rc.3.26522.148 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

You can build .NET 10.0 from the repository by cloning the release tag v10.0.403 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

You can build .NET 8.0 from the repository by cloning the release tag v8.0.133 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

You can build .NET 9.0 from the repository by cloning the release tag v9.0.123 and following the build instructions in the main README.md.

Alternatively, you can build from the sources attached to this release directly.
More information on this process can be found in the dotnet/dotnet repository.

Attached are PGP signatures for the GitHub generated tarball and zipball. You can find the public key at https://dot.net/release-key-2023

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3. We recommend updating as soon as possible.

Security updates

This out-of-band release addresses CVE-2026-111497, a vulnerability in the Brotli decompression algorithm. It also includes a fix for CVE-2026-114148 (Linux .NET tarball ownership) in .NET 8, 9, 10, and 11.

Applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs. Request decompression and automatic response decompression are not enabled by default. .NET Framework is not affected.

For .NET 10 and .NET 11, CVE-2026-114148 affects source-build tarballs only. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs, including users who do not build .NET from source.

For vulnerability details and affected products, see the linked security advisories.

Additionally, we are re-releasing the advisories for CVE-2026-70197 (SocketAsyncEventArgs memory corruption) in .NET 8, 9, 10, and 11, and CVE-2026-102870 (Blazor WebAssembly debugger) in .NET 10 and 11 because the October 13, 2026 release did not fully address these issues. Today’s updates provide those fixes.

Download the updates

.NET 11 RC2 users should update to RC3 to receive these fixes.

Update your applications and build environments

• Framework-dependent applications: Install the updated runtime for the .NET version your application targets, then restart the application.
• Self-contained applications: Rebuild and republish with the updated runtime. Installing a newer runtime on the host does not update the runtime bundled with your application.
• Containers: Rebuild and redeploy using updated .NET container images.
• Source-build consumers: Obtain the updated source-build artifacts for your .NET version and rebuild your packages to incorporate the tarball ownership fix.
• ASP.NET Core tarball users on .NET 8 and .NET 9: Update your installation using the refreshed ASP.NET Core Runtime tarball for your .NET version. This applies even if you do not build .NET from source.

You can check the runtimes installed on a machine with:

dotnet --list-runtimes

For framework-dependent deployments, confirm that the appropriate updated runtime listed above is installed. Self-contained applications and container deployments must be checked separately because they carry their own runtime.

See the .NET deployment documentation for more information about framework-dependent and self-contained applications.

Feedback

If you encounter a problem after updating, report it in the .NET release feedback issues.

The post .NET October 2026 Out-of-Band Security Updates appeared first on .NET Blog.