CVE-2026-111497
EUVD-2026-10816922.10.2026, 14:17
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| brotli | 1.0.3 ≤ 𝑥 < 1.0.10 | CNA | |
| brotli | 1.1.0 ≤ 𝑥 < 1.1.1 | CNA | |
| brotli | 1.2.0 ≤ 𝑥 < 1.2.1 | CNA |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| brotli |
| ||||||||||||||||
| nodejs |
|
Common Weakness Enumeration
Vulnerability Media Exposure