Khai Tran and Sylvie Mayer of OpenAI Codex Security reported one critical Brotli decoder flaw, CVE-2026-111497, affecting three Unicon on-prem components identified in a Citrix advisory: UniconOS Management (Scout), its Scout LTSR branch, and Scout Cloud Gateway (SCG).
An unchecked return value in Brotli’s decoder lets a crafted compressed stream write beyond the memory reserved for it. A remote, unauthenticated sender could use that out-of-bounds write to corrupt memory; the advisory lists possible information disclosure, service disruption, and code execution.
For teams running these products, the shared decoder puts management and gateway systems in the same exposure picture. A fix applied to Scout alone does not establish that the separate LTSR branch or Cloud Gateway is covered; each component has a distinct fix, so deployment inventories determine whether exposure remains.
CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: Release Notes.