MSRXCVE-2026-111497
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS 4.0 · CNA
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected packages and fixed versions
| Package | Ecosystem | Fixed in |
|---|---|---|
| brotli | PyPI | 1.2.1 |
| brotlicffi | PyPI | 1.2.1.0 |
Affected products
- Google Brotli: 1.0.3 to < 1.0.10; 1.1.0 to < 1.1.1; 1.2.0 to < 1.2.1
Also known as: BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323
2 references (advisories, patches, write-ups)
Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.