Skip to main content
Apexward Pulse

Google · Code execution

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497

What this means

This is rated critical severity (9.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Google Brotli, Nodejs Node.js and Python Hyper Brotlicffi, and 23 more are in your estate, and treat that as the priority.

Full vendor description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Scoring and exploitation

9.2/ 10
CVSS 4.0 base scoreCritical

Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsPresentAT:P
Privileges requiredNonePR:N
User interactionNoneUI:N

Impact

Longer bar: more harm

ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
Elevated attack likelihood (~82.6% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Google Brotli

Weaknesses

CWE-252CWE-787

Affected products ()

  • Google Brotli
  • Nodejs Node.js
  • Python Hyper Brotlicffi
  • Microsoft .net
  • Debian Debian Linux
  • Istio Istio
  • Anthropic Bun
  • Envoyproxy Envoy
  • Tianocore edk2
  • Google woff2
  • Duckdb Duckdb
  • Clickhouse Clickhouse
  • Apache Arrow
  • Mcmilk 7 Zip Zstd
  • 7 Zip p7zip
  • Andybalholm Brotli
  • Siemens Ruggedcom ape1808 Firmware
  • Siemens Ruggedcom ape1808
  • Siemens Common Configurator
  • Siemens Data Flow Monitoring
  • Siemens Edge Opc Ua Server Configurator
  • Siemens Flow Creator Configurator
  • Siemens Industrial Edge Cloud Connector Configurator
  • Siemens Industrial Edge Databus Configurator
  • Siemens Industrial Edge Hub
  • Siemens Industrial Edge Management Cloud
Show the raw CPE strings (36)
  • cpe:2.3:a:google:brotli:*:*:*:*:*:-:*:*
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  • cpe:2.3:a:python-hyper:brotlicffi:*:*:*:*:*:python:*:*
  • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:.net:11.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
  • cpe:2.3:a:anthropic:bun:*:*:*:*:*:*:*:*
  • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
  • cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*
  • cpe:2.3:a:google:woff2:-:*:*:*:*:*:*:*
  • cpe:2.3:a:duckdb:duckdb:*:*:*:*:*:*:*:*
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:arrow:27.0.0:dev:*:*:*:*:*:*
  • cpe:2.3:a:mcmilk:7-zip-zstd:*:*:*:*:*:*:*:*
  • cpe:2.3:a:7-zip:p7zip:*:*:*:*:*:*:*:*

Showing 25 of 36 matches from .

References

20 links from the CVE record, grouped by site.

Related feed events