Cyber & AI intelligence
Wasteland.
Briefs indexed3297
Issues34
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-111497 2026-10-27

Google Brotli Decoder Flaw CVE-2026-111497 Is Being Actively Exploited

"CISA has added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog: a critical memory-corruption flaw in the Google Brotli decoder that remote, unauthenticated attackers can trigger with a crafted…"

CISA has added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog: a critical memory-corruption flaw in the Google Brotli decoder that remote, unauthenticated attackers can trigger with a crafted compressed stream. Federal agencies must remediate it by November 10, 2026.

What Is It

CVE-2026-111497 is a vulnerability in the Brotli decoder (c/dec/decode.c). CISA calls it an unchecked return value vulnerability. NVD's description calls it a buffer overflow. The weaknesses listed are CWE-252 (Unchecked Return Value) and CWE-787 (Out-of-bounds Write).

A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to: - corrupt adjacent decoder state memory - disclose sensitive memory contents - cause a denial of service - potentially execute arbitrary code

Why It Matters

CISA added the flaw to KEV on October 27, 2026, which confirms active exploitation. CISA's SSVC assessment also rates exploitation as "active" and technical impact as "total." Google scored it 9.2 (CRITICAL) under CVSS 4.0, with a network attack vector, low attack complexity, and no privileges or user interaction required. The vector also shows that certain attack conditions must be present (AT:P). Whether it has been used in ransomware campaigns is listed as "Unknown."

CISA notes that the flaw sits in an open-source component that many different products may use. The NVD references include advisories from Node.js, .NET, the Go Brotli port (andybalholm/brotli) and Debian LTS. Node.js describes its issue as a Brotli decoder out-of-bounds write that permits remote code execution.

What's Vulnerable

Google Brotli versions 1.0.3 through 1.2.0 are affected on all platforms: - 1.0.3 up to (not including) 1.0.10 - 1.1.0 up to (not including) 1.1.1 - 1.2.0 up to (not including) 1.2.1

Any library or binary built from an affected Brotli version should be considered exposed.

Patch Status

Google has released fixed versions 1.0.10, 1.1.1 and 1.2.1. NVD advises updating any Brotli library or binary in the affected range to one of these versions.

CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and its Forensics Triage Requirements. If mitigations are unavailable, follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders should check each asset's internet exposure. The federal due date is November 10, 2026.

Downstream projects have issued their own advisories. Check whether the runtimes and packages you use bundle their own copy of Brotli.

Sources