AZL-111518: CVE-2026-111497 affecting package p7zip 16.02-23

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted Brotli-compressed stream to a vulnerable Brotli decoder. The attack can be performed remotely without authentication when such a stream is processed.

Q: How can I determine whether my environment is affected?

Inventory Brotli libraries and binaries used by the affected software. Versions from 1.0.3 through 1.2.0 are affected on all platforms.

Q: Which Brotli versions should be used for remediation?

Update affected Brotli libraries or binaries to the latest available fixed release identified in the advisory: 1.0.10, 1.1.1, or 1.2.1.

Published Oct 22, 2026

Updated

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Affected Software

1 affected component

azure-linux/p7zip<=16.02-23

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.0.10
Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.1.1
Upgrade
Upgrade Google Brotli to a version that resolves this vulnerability.
Fixed in 1.2.1

Event History

Oct 22, 2026

Advisory Published

via OSV·02:17 PM

Data Sourced

via OSV·02:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-111497

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to provide a crafted Brotli-compressed stream to a vulnerable Brotli decoder. The attack can be performed remotely without authentication when such a stream is processed.

How can I determine whether my environment is affected?

Inventory Brotli libraries and binaries used by the affected software. Versions from 1.0.3 through 1.2.0 are affected on all platforms.

Which Brotli versions should be used for remediation?

Update affected Brotli libraries or binaries to the latest available fixed release identified in the advisory: 1.0.10, 1.1.1, or 1.2.1.

AZL-111518: CVE-2026-111497 affecting package p7zip 16.02-23

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

How can I determine whether my environment is affected?

Which Brotli versions should be used for remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

How can I determine whether my environment is affected?

Which Brotli versions should be used for remediation?