Vulnerabilities · 4h ago

PHP for Windows rebuild masks its Brotli security fix

INCIBE-CERT reports that PHP for Windows has four rebuilds fixing a critical flaw in bundled Brotli: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The “-1” marks the rebuild with Brotli 1.2.1; the PHP interpreter version itself is unchanged. The flaw is CVE-2026-111497.

A crafted compressed response can make Brotli write beyond a buffer while decoding it. cURL can reach that decoder when automatic HTTP-response decompression is enabled—a setting that is off by default but can be turned on by an application or library. If reached, the flaw can expose information, disrupt service or allow code execution.

For Windows PHP environments using cURL, the interpreter version alone does not show whether the fixed Brotli build is installed. Exposure also depends on whether the application stack enables automatic decompression.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 88% (100th percentile). Microsoft patch: Release Notes.

Patch available KB5133964 Download →

CISA federal remediation date Nov 10

Timeline

Nov 10 CISA federal deadline for CVE-2026-111497
Oct 29 Reported by INCIBE-CERT
Oct 27 CVE-2026-111497 added to CISA KEV

Sources

1 source covering this story

INCIBE-CERT Oct 29
Escritura fuera de límites en PHP para Windows
Khai Tran y Sylvie Mayer, de OpenAI Codex Security, han informado sobre 1 vulnerabilidad de severidad

Entities

CVE-2026-111497

Part of the PlainSec briefing for 2026-10-29

Editions

Briefing for 2026-10-29

Vulnerabilities · 4h agoPHP for Windows rebuild masks its Brotli security fixINCIBE-CERT reports that PHP for Windows has four rebuilds fixing a critical flaw in bundled Brotli: 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. The “-1” marks the rebuild with Brotli 1.2.1; the PHP interpreter version itself is unchanged. The flaw is CVE-2026-111497.A crafted compressed response can make Brotli write beyond a buffer while decoding it. cURL can reach that decoder when automatic HTTP-response decompression is enabled—a setting that is off by default but can be turned on by an application or library. If reached, the flaw can expose information, disrupt service or allow code execution.For Windows PHP environments using cURL, the interpreter version alone does not show whether the fixed Brotli build is installed. Exposure also depends on whether the application stack enables automatic decompression.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 88% (100th percentile). Microsoft patch: Release Notes.