Vulnerabilities · 10h ago

Brotli flaw leaves three Unicon products exposed

Khai Tran and Sylvie Mayer of OpenAI Codex Security reported one critical Brotli decoder flaw, CVE-2026-111497, affecting three Unicon on-prem components identified in a Citrix advisory: UniconOS Management (Scout), its Scout LTSR branch, and Scout Cloud Gateway (SCG).

An unchecked return value in Brotli’s decoder lets a crafted compressed stream write beyond the memory reserved for it. A remote, unauthenticated sender could use that out-of-bounds write to corrupt memory; the advisory lists possible information disclosure, service disruption, and code execution.

For teams running these products, the shared decoder puts management and gateway systems in the same exposure picture. A fix applied to Scout alone does not establish that the separate LTSR branch or Cloud Gateway is covered; each component has a distinct fix, so deployment inventories determine whether exposure remains.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: Release Notes.

Patch available KB5133964 Download →

CISA federal remediation date Nov 10

Timeline

Nov 10 CISA federal deadline for CVE-2026-111497
Nov 4 Reported by INCIBE-CERT
Oct 27 CVE-2026-111497 added to CISA KEV

Sources

1 source covering this story

INCIBE-CERT Nov 4
Escritura fuera de límites en productos de Citrix
Khai Tran y Sylvie Mayer, de OpenAI Codex Security, han informado sobre una vulnerabilidad de severida

Entities

CVE-2026-111497

Part of the PlainSec briefing for 2026-11-04

Editions

Briefing for 2026-11-04

Vulnerabilities · 10h agoBrotli flaw leaves three Unicon products exposedKhai Tran and Sylvie Mayer of OpenAI Codex Security reported one critical Brotli decoder flaw, CVE-2026-111497, affecting three Unicon on-prem components identified in a Citrix advisory: UniconOS Management (Scout), its Scout LTSR branch, and Scout Cloud Gateway (SCG).An unchecked return value in Brotli’s decoder lets a crafted compressed stream write beyond the memory reserved for it. A remote, unauthenticated sender could use that out-of-bounds write to corrupt memory; the advisory lists possible information disclosure, service disruption, and code execution.For teams running these products, the shared decoder puts management and gateway systems in the same exposure picture. A fix applied to Scout alone does not establish that the separate LTSR branch or Cloud Gateway is covered; each component has a distinct fix, so deployment inventories determine whether exposure remains.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: Release Notes.