CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Details

Frequently asked questions

Is CVE-2026-111497 being actively exploited?

Yes — CISA lists CVE-2026-111497 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2026-111497 affect?

CVE-2026-111497 affects Google · Brotli.

How do I fix CVE-2026-111497?

Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 10, 2026. Then check whether your personal data was exposed in any related breach.

References

• github.com/andybalholm/brotli/releases/tag/v1.2.7
• nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-de
• www.openwall.com/lists/oss-security/2026/10/23/25
• www.openwall.com/lists/oss-security/2026/10/24/6
• www.openwall.com/lists/oss-security/2026/10/26/12
• www.openwall.com/lists/oss-security/2026/10/26/13
• www.openwall.com/lists/oss-security/2026/10/26/16
• broccoli2shell.com

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities