CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Fixed versions are available, and users should update to versions 1.0.10, 1.1.1, 1.2.1 or later.