CVE-2026-111497: presente nel catalogo CISA KEV CVE-2026-111497 · KEV 2026-10-27 · patch disponibile
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-111497 viene sfruttato? Inserito nel catalogo CISA KEV il 2026-10-27. Scadenza di remediation federale: 2026-11-10. Codice di exploit pubblico: nessuno trovato nelle fonti monitorate. Quali prodotti e versioni sono interessati? Google · Brotli · >= 1.0.3, < 1.0.10, >= 1.1.0, < 1.1.1, >= 1.2.0, < 1.2.1 Microsoft · azl3 brotli 1.1.0-2 on Azure Linux 3.0 Microsoft · .NET 8.0 installed on Linux Microsoft · .NET 8.0 installed on Mac OS Microsoft · .NET 8.0 installed on Windows Microsoft · .NET 9.0 installed on Linux Microsoft · .NET 9.0 installed on Mac OS Microsoft · .NET 9.0 installed on Windows Microsoft · .NET 10.0 installed on Linux Microsoft · .NET 10.0 installed on Mac OS Microsoft · .NET 10.0 installed on Windows Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
Brotli 1.0.3 1.0.10 Brotli 1.1.0 1.1.1 Brotli 1.2.0 1.2.1
Dal record CVE di Google
azl3 brotli 1.1.0-2 on Azure Linux 3.0 1.2.1-1 .NET 8.0 installed on Linux 8.0.427 .NET 8.0 installed on Mac OS 8.0.427 .NET 8.0 installed on Windows 8.0.427 .NET 9.0 installed on Linux 9.0.320 .NET 9.0 installed on Mac OS 9.0.320 .NET 9.0 installed on Windows 9.0.320 .NET 10.0 installed on Linux 10.0.403 .NET 10.0 installed on Mac OS 10.0.403 .NET 10.0 installed on Windows 10.0.403
Dalla Security Update Guide di Microsoft · Advisory di Microsoft
Cosa ha pubblicato PlainSec su CVE-2026-111497 Fonti primarie Cosa questa scheda non dice Nessun punteggio CVSS da NVD. Nessun punteggio EPSS. KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-10-27.
CVE-2026-111497: presente nel catalogo CISA KEV CVE-2026-111497 · KEV 2026-10-27 · patch disponibile
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-111497 viene sfruttato? Inserito nel catalogo CISA KEV il 2026-10-27. Scadenza di remediation federale: 2026-11-10. Codice di exploit pubblico: nessuno trovato nelle fonti monitorate. Quali prodotti e versioni sono interessati? Google · Brotli · >= 1.0.3, < 1.0.10, >= 1.1.0, < 1.1.1, >= 1.2.0, < 1.2.1 Microsoft · azl3 brotli 1.1.0-2 on Azure Linux 3.0 Microsoft · .NET 8.0 installed on Linux Microsoft · .NET 8.0 installed on Mac OS Microsoft · .NET 8.0 installed on Windows Microsoft · .NET 9.0 installed on Linux Microsoft · .NET 9.0 installed on Mac OS Microsoft · .NET 9.0 installed on Windows Microsoft · .NET 10.0 installed on Linux Microsoft · .NET 10.0 installed on Mac OS Microsoft · .NET 10.0 installed on Windows Esiste una patch? Sì. Aggiorna a una di queste versioni o successive:
Brotli 1.0.3 1.0.10 Brotli 1.1.0 1.1.1 Brotli 1.2.0 1.2.1
Dal record CVE di Google
azl3 brotli 1.1.0-2 on Azure Linux 3.0 1.2.1-1 .NET 8.0 installed on Linux 8.0.427 .NET 8.0 installed on Mac OS 8.0.427 .NET 8.0 installed on Windows 8.0.427 .NET 9.0 installed on Linux 9.0.320 .NET 9.0 installed on Mac OS 9.0.320 .NET 9.0 installed on Windows 9.0.320 .NET 10.0 installed on Linux 10.0.403 .NET 10.0 installed on Mac OS 10.0.403 .NET 10.0 installed on Windows 10.0.403
Dalla Security Update Guide di Microsoft · Advisory di Microsoft
Cosa ha pubblicato PlainSec su CVE-2026-111497 Fonti primarie Cosa questa scheda non dice Nessun punteggio CVSS da NVD. Nessun punteggio EPSS. KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-10-27.