Google Brotli Unchecked Return Value Vulnerability
TL;DR 📌
- Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- Highest CVSS: 9.2 (Critical).
- Listed in CISA KEV (2026-10-27) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-111497.
What it is
CVE-2026-111497 is a buffer overflow in the Brotli decoder, specifically in c/dec/decode.c, caused by an unchecked return value. Brotli is a general-purpose compression library used widely as a dependency inside web servers, browsers, CDNs, and any software that decompresses Brotli-encoded content.
The flaw is triggered when the decoder processes a crafted Brotli-compressed stream. No authentication is required, and the attacker does not need prior access to the system — they simply need to get a malicious compressed payload to a point where it will be decompressed, for example via HTTP content-encoding. Exploitation corrupts adjacent decoder state memory.
Depending on how the memory corruption plays out, this can disclose sensitive memory contents, crash the decoding process (denial of service), or lead to arbitrary code execution. Because Brotli is embedded rather than run as a standalone service, the actual exposure depends on which application or library on a given host has it linked in and how it’s exposed — anything that accepts and decompresses untrusted Brotli streams is in scope.
This affects Brotli versions 1.0.3 through 1.2.0, on all platforms. It is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 27 October 2026.
What to do
- Update any Brotli library or binary in the 1.0.3–1.2.0 range to 1.0.10, 1.1.1, or 1.2.1, as specified in the NVD entry.
- Since Brotli is typically a transitive dependency, don’t just check for a standalone “brotli” package — identify every application, web server module, browser, or CDN component that statically or dynamically links an affected Brotli version, and patch or rebuild those separately.
- Given the KEV listing, treat this as a priority patching item rather than something to schedule into routine maintenance.
- Where immediate patching isn’t possible, consider disabling Brotli content-encoding support on internet-facing services so that untrusted compressed streams aren’t passed to the vulnerable decoder.
- After patching, confirm the in-use Brotli version at runtime (not just in package manifests) for any component that vendors or bundles its own copy, since outdated vendored copies are a common way this kind of fix gets missed.
For leadership 🧭
Executive summary. Brotli is embedded inside web servers, browsers, CDNs and countless applications that decompress HTTP content-encoded traffic, and a crafted compressed stream can corrupt decoder memory with no authentication required. This is already listed in CISA’s Known Exploited Vulnerabilities catalogue, so affected components need to be identified and patched now, not on the next maintenance cycle.
Why it matters:
- The vulnerable code sits in c/dec/decode.c, the core Brotli decompression routine, so any application, web server module, browser, or CDN edge that statically or dynamically links Brotli 1.0.3 through 1.2.0 is exposed.
- An unauthenticated remote attacker only needs to get a crafted Brotli-compressed payload decompressed, for example via HTTP content-encoding, requiring no prior access or user interaction.
- Outcomes range from memory disclosure to a crashed decoding process to arbitrary code execution, depending on how the decoder state corruption resolves.
- The flaw is already in CISA’s KEV catalogue as of 27 October 2026, so it should be treated as a priority patching item ahead of routine updates.
Now / Next / Later:
- Now:
- Next:
- Later: now - placeholder