CVE-2026-111497: listed in the CISA KEV catalog CVE-2026-111497 · KEV 2026-10-27 · patch available
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Is CVE-2026-111497 exploited? Listed in the CISA KEV catalog on 2026-10-27. Federal remediation due 2026-11-10. Public exploit code: none found in monitored sources. Which products and versions are affected? Google · Brotli · >= 1.0.3, < 1.0.10, >= 1.1.0, < 1.1.1, >= 1.2.0, < 1.2.1 Microsoft · azl3 brotli 1.1.0-2 on Azure Linux 3.0 Microsoft · .NET 8.0 installed on Linux Microsoft · .NET 8.0 installed on Mac OS Microsoft · .NET 8.0 installed on Windows Microsoft · .NET 9.0 installed on Linux Microsoft · .NET 9.0 installed on Mac OS Microsoft · .NET 9.0 installed on Windows Microsoft · .NET 10.0 installed on Linux Microsoft · .NET 10.0 installed on Mac OS Microsoft · .NET 10.0 installed on Windows Is there a patch? Yes. Update to one of these or later:
Brotli 1.0.3 1.0.10 Brotli 1.1.0 1.1.1 Brotli 1.2.0 1.2.1
From Google's CVE record
azl3 brotli 1.1.0-2 on Azure Linux 3.0 1.2.1-1 .NET 8.0 installed on Linux 8.0.427 .NET 8.0 installed on Mac OS 8.0.427 .NET 8.0 installed on Windows 8.0.427 .NET 9.0 installed on Linux 9.0.320 .NET 9.0 installed on Mac OS 9.0.320 .NET 9.0 installed on Windows 9.0.320 .NET 10.0 installed on Linux 10.0.403 .NET 10.0 installed on Mac OS 10.0.403 .NET 10.0 installed on Windows 10.0.403
From Microsoft's Security Update Guide · Microsoft advisory
What PlainSec published about CVE-2026-111497 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-27.
CVE-2026-111497: listed in the CISA KEV catalog CVE-2026-111497 · KEV 2026-10-27 · patch available
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Is CVE-2026-111497 exploited? Listed in the CISA KEV catalog on 2026-10-27. Federal remediation due 2026-11-10. Public exploit code: none found in monitored sources. Which products and versions are affected? Google · Brotli · >= 1.0.3, < 1.0.10, >= 1.1.0, < 1.1.1, >= 1.2.0, < 1.2.1 Microsoft · azl3 brotli 1.1.0-2 on Azure Linux 3.0 Microsoft · .NET 8.0 installed on Linux Microsoft · .NET 8.0 installed on Mac OS Microsoft · .NET 8.0 installed on Windows Microsoft · .NET 9.0 installed on Linux Microsoft · .NET 9.0 installed on Mac OS Microsoft · .NET 9.0 installed on Windows Microsoft · .NET 10.0 installed on Linux Microsoft · .NET 10.0 installed on Mac OS Microsoft · .NET 10.0 installed on Windows Is there a patch? Yes. Update to one of these or later:
Brotli 1.0.3 1.0.10 Brotli 1.1.0 1.1.1 Brotli 1.2.0 1.2.1
From Google's CVE record
azl3 brotli 1.1.0-2 on Azure Linux 3.0 1.2.1-1 .NET 8.0 installed on Linux 8.0.427 .NET 8.0 installed on Mac OS 8.0.427 .NET 8.0 installed on Windows 8.0.427 .NET 9.0 installed on Linux 9.0.320 .NET 9.0 installed on Mac OS 9.0.320 .NET 9.0 installed on Windows 9.0.320 .NET 10.0 installed on Linux 10.0.403 .NET 10.0 installed on Mac OS 10.0.403 .NET 10.0 installed on Windows 10.0.403
From Microsoft's Security Update Guide · Microsoft advisory
What PlainSec published about CVE-2026-111497 Primary sources What this record does not say No CVSS score from NVD. No EPSS score. KEV and EPSS are re-checked daily. Record last updated 2026-10-27.