Google Brotli decoder out-of-bounds write can allow remote code execution (CVE-2026-111497)

What happened

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, in c/dec/decode.c, affecting Google Brotli 1.0.3 through 1.2.0 on all platforms. A remote attacker can supply a crafted Brotli-compressed stream and, with no credentials or user interaction, corrupt adjacent decoder state memory. The possible outcomes are disclosure of sensitive memory contents, denial of service, or arbitrary code execution.

The CVSS 4.0 score is 9.2, rated critical, with high impact on confidentiality, integrity and availability. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-27, with a due date of 2026-11-10. CISA SSVC marks exploitation as active, and ENISA EUVD records exploitation since 2026-10-27. The EPSS score is 88.

Who is affected

The affected component is Google Brotli 1.0.3 through before 1.0.10, 1.1.0 through before 1.1.1, and 1.2.0 through before 1.2.1. The vendor statements in the record also list Node.js 26.x, 24.x and 22.x as affected. Brotli is a compression library embedded in products that process Brotli-compressed streams, so exposure can reach any application that decodes such input.

What to do now

1. Identify every installed component that bundles Brotli 1.0.3 through 1.2.0, including Node.js 26.x, 24.x, 22.x and any appliance or client software that decodes Brotli-compressed streams.
2. Update Brotli to a fixed release: 1.0.10, 1.1.1 or 1.2.1, depending on your current line. Apply the product-specific fixed builds listed for this CVE where you consume Brotli indirectly through Node.js, PAN-OS or another product.
3. Prioritise internet-facing systems that accept or process compressed content. CISA's KEV due date is 2026-11-10, and its required action includes BOD 26-04 patching and forensics triage.
4. If a relevant fix is not available for an embedded component, follow CISA's guidance: apply mitigation, restrict exposure, or discontinue use of the product.

How to detect it

The public sources listed do not include specific indicators of compromise. Focus monitoring on systems that handle untrusted Brotli-compressed data — internet-facing web servers, Node.js services and appliances. Look for memory-corruption symptoms such as unexpected crashes or unusual process behaviour in those components, and follow CISA's Forensics Triage Requirements from the KEV entry when investigating potential exploitation.

Beyond the patch

Because CISA KEV, CISA SSVC and ENISA EUVD all record exploitation, response readiness matters as much as patching. Managed Detection & Response (MDR) can detect post-exploitation activity on internet-facing Brotli handlers, and Incident Response Retainer gives you a tested path if a vulnerable service is already compromised. For organisations that lack continuous oversight of exposed services, Virtual CISO Services can help identify the open ports and unauthenticated paths this vulnerability needs.