Advisory · CVE-2026-111497
Actively exploited Brotli decoder overflow can corrupt memory and execute code from a crafted stream
Google Brotli 1.0.3 through 1.2.0 contain a decoder buffer overflow that lets a remote unauthenticated attacker corrupt adjacent decoder state, disclose memory, cause denial of service, or potentially execute arbitrary code with a crafted Brotli-compressed stream. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026. CVSS 4.0 9.2.
- Vendor
- Product
- Brotli
- Identifier / CWE
- CVE-2026-111497
CWE-252, CWE-787 - Action timing
- Nov 10, 2026
Explain it like I’m five
Brotli decompresses data all over the internet. A rigged compressed stream can make the decoder write outside the space it set aside, scrambling nearby memory in whatever program trusted it, which can be turned into running the attacker's code.
- 01Crafted stream delivered
The attacker supplies a malicious Brotli-compressed stream to any application that decompresses untrusted data.
- 02Decoder processes it
The vulnerable decoder in c/dec/decode.c handles the stream without catching the failing condition.
- 03Memory corrupts
The decoder corrupts adjacent decoder state memory outside its intended bounds.
- 04Impact lands
The host application can disclose memory, crash, or potentially execute attacker code.
What happened
CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal remediation due date of November 10, 2026. Google’s record describes a buffer overflow in the Brotli decoder (CWE-252, CWE-787) in versions 1.0.3 through 1.2.0 on all platforms: a remote unauthenticated attacker can corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. The record rates it CVSS 4.0 9.2.
Per Google’s record, users should update Brotli libraries or binaries from the affected ranges to 1.0.10, 1.1.1, or 1.2.1, matching their branch: 1.0.3 up to 1.0.10, 1.1.0 up to 1.1.1, and 1.2.0 up to 1.2.1 are the affected spans. Brotli is embedded in browsers, servers, runtimes, and countless libraries, so the vulnerable copy is often a bundled one rather than a system package.
What to do
- Inventory Brotli copies across servers, containers, runtimes, and applications, including vendored and statically linked copies, not just OS packages.
- Update affected copies to 1.0.10, 1.1.1, or 1.2.1 according to the branch in use, and rebuild or redeploy statically linked applications.
- Prioritize internet-facing services that decompress request bodies, archives, or uploaded content with Brotli.
- Check framework and runtime release notes (for example Node.js and .NET, which both published related updates) and apply their patched builds where they bundle Brotli.
- Review crash logs and memory-error telemetry for decoder faults on services that handled untrusted compressed content.
- Verify the deployed library version after updating, including inside container images and bundled binaries.
Management note
Library vulnerabilities with KEV status are inventory problems before they are patch problems: nobody can patch a copy they do not know exists. Use the federal due date as the deadline for a full Brotli census, with bundled copies counted, not just packaged ones.