CVE-2026-111497: Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Brotlito a version that resolves this vulnerability.Fixed in 1.0.10 - Upgrade
Upgrade
Google Brotlito a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade
Google Brotlito a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any deployment on any platform that uses a Google Brotli library or binary version from 1.0.3 through 1.2.0 is affected. The issue is in the Brotli decoder, so exposure depends on processing Brotli-compressed streams.
What does an attacker need to exploit the vulnerability?
An attacker can be remote and unauthenticated, but needs to supply a crafted Brotli-compressed stream to a vulnerable decoder. Successful exploitation may corrupt adjacent decoder state memory, disclose memory, cause denial of service, or potentially execute arbitrary code.
What versions should be deployed to remediate the issue?
Update affected Brotli libraries or binaries to the latest available version identified as 1.0.10, 1.1.1, or 1.2.1. Versions in the 1.0.3 through 1.2.0 range should be treated as needing an update.