PHP for Windows rebuild masks its Brotli security fix
INCIBE-CERT reports that PHP for Windows has four rebuilds fixing a critical flaw in bundled Brotli: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The “-1” marks the rebuild with Brotli 1.2.1; the PHP interpreter version itself is unchanged. The flaw is CVE-2026-111497.
A crafted compressed response can make Brotli write beyond a buffer while decoding it. cURL can reach that decoder when automatic HTTP-response decompression is enabled—a setting that is off by default but can be turned on by an application or library. If reached, the flaw can expose information, disrupt service or allow code execution.
For Windows PHP environments using cURL, the interpreter version alone does not show whether the fixed Brotli build is installed. Exposure also depends on whether the application stack enables automatic decompression.
CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 88% (100th percentile). Microsoft patch: Release Notes.