CVE-2026-111497 is a critical-severity vulnerability affecting Google Brotli. A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) that could allow a remote unauthenticated attacker to corrupt memory, disclose sensitive information, cause a denial of service, or potentially execute arbitrary code by supplying a specially crafted Brotli-compressed stream.

This vulnerability affects Google Brotli versions:

Google Brotli 1.1.0 – (Affected)
Google Brotli 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9 – (Affected)
Google Brotli 1.2.0 – (Affected)

An attacker may exploit this vulnerability by sending a specifically crafted Brotli-compressed file or network response to an application that uses a vulnerable Brotli decoder.

Step 1 - Identify a Vulnerable Application

The attacker identifies an application, web server, API, or service using a vulnerable Brotli library.

Step 2 - Craft a Malicious Brotli Stream

The attacker creates a specially crafted Brotli-compressed payload designed to trigger the buffer overflow vulnerability.

Step 3 - Deliver the Payload

The malicious payload is delivered through web traffic, compressed content, APIs, or files processed by the vulnerable application.

Step 4 - Trigger Memory Corruption

When the vulnerable Brotli decoder processes the malicious data, memory corruption occurs due to an out-of-bounds write.

Step 5 - Compromise System

Successful exploitation could result in denial of service, information disclosure, or remote code execution within the affected application.

CERTVU recommends the following:

1. Upgrade Immediately

   Upgrade affected Brotli installations to one of the following fixed versions: Google Brotli 1.0.10, Google Brotli 1.1.1, Google Brotli 1.2.1.

2. Update Dependent Applications

   Ensure applications and libraries that bundle Brotli are updated to a version that links against a fixed decoder.

3. Restrict Processing of Untrusted Compressed Data

   Avoid decompressing Brotli-compressed content received from untrusted or unknown sources until updates have been applied.

4. Monitor for Indicators of Compromise

   Review application and system logs for application crashes related to Brotli decompression, unexpected memory access violations, unusual process behaviour, and malformed Brotli-compressed requests or responses.

5. Deploy Security Updates Promptly

   Ensure operating systems, application frameworks, and third-party software packages that utilize Brotli are updated as vendors release fixes.