CVE-2026-111497: CWE-787 Out-of-bounds Write in Google Brotli

This vulnerability (CVE-2026-111497) is a buffer overflow in the Brotli decoder implementation (c/dec/decode.c) affecting Google Brotli versions 1.0.3 through 1.2.0 on all platforms. It enables remote unauthenticated attackers to corrupt adjacent decoder state memory, which can lead to information disclosure, denial of service, or potentially arbitrary code execution when processing maliciously crafted Brotli-compressed data streams. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity. Fixed versions are 1.0.10, 1.1.1, and 1.2.1.

Successful exploitation can result in memory corruption that may disclose sensitive memory contents, cause denial of service by crashing the decoder, or allow execution of arbitrary code. This impacts all platforms running affected Brotli versions, posing a critical security risk.

Users should update any Brotli libraries or binaries from affected versions (>=1.0.3 <1.0.10, >=1.1.0 <1.1.1, >=1.2.0 <1.2.1) to the fixed versions 1.0.10, 1.1.1, or 1.2.1. No other mitigations are indicated by the vendor advisory.