Skip to main content
Meo

Security tracker

CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability

In short

Google Brotli has a weakness classified as unchecked return value (CWE-252). CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-27. NVD lists CVSS 4.0 at 9.2 CRITICAL.

What it is

“Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.” — CISA KEV, retrieved 2026-11-01
“A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.” — NVD, retrieved 2026-11-01

Who is affected

Google Brotli. NVD lists the following versions as affected:

  • Google Brotli: from 1.0.3 inclusive, before 1.0.10
  • Google Brotli: from 1.1.0 inclusive, before 1.1.1
  • Google Brotli: from 1.2.0 inclusive, before 1.2.1
  • Nodejs node.js: before 22.23.4
  • Nodejs node.js: from 23.0.0 inclusive, before 24.22.1
  • Nodejs node.js: from 25.0.0 inclusive, before 26.12.1
  • python-hyper Brotlicffi: before 1.2.1.0
  • Microsoft .net: from 8.0.0 inclusive, before 8.0.33
  • Microsoft .net: from 9.0.0 inclusive, before 9.0.22
  • Microsoft .net: from 10.0.0 inclusive, before 10.0.14
  • Microsoft .net: version 11.0.0
  • Debian Debian Linux: version 12.0
  • Istio Istio: before 1.29.9
  • Istio Istio: from 1.30.0 inclusive, before 1.30.6
  • Istio Istio: from 1.31.0 inclusive, before 1.31.2
  • Anthropic Bun: before 1.4.4
  • Envoyproxy Envoy: before 1.37.8
  • Envoyproxy Envoy: from 1.38.0 inclusive, before 1.38.6
  • Envoyproxy Envoy: from 1.39.0 inclusive, before 1.39.3
  • Tianocore edk2: through 202608
  • Google woff2: all versions listed (no range given)
  • Duckdb Duckdb: through 2.0.0
  • Clickhouse Clickhouse: through 26.10.2.103
  • Apache Arrow: through 26.0.0
  • Apache Arrow: version 27.0.0
  • Mcmilk 7-zip-zstd: through 26.02-1.5.7-r2
  • 7-zip p7zip: through 16.02
  • Andybalholm Brotli: before 1.2.7
  • Siemens Ruggedcom ape1808 Firmware: all versions listed (no range given)
  • Siemens Common Configurator: all versions listed (no range given)
  • Siemens Data Flow Monitoring: all versions listed (no range given)
  • Siemens Edge Opc Ua Server Configurator: all versions listed (no range given)
  • Siemens Flow Creator Configurator: all versions listed (no range given)
  • Siemens Industrial Edge Cloud Connector Configurator: all versions listed (no range given)
  • Siemens Industrial Edge Databus Configurator: all versions listed (no range given)
  • Siemens Industrial Edge Hub: all versions listed (no range given)
  • Siemens Industrial Edge Management Cloud: all versions listed (no range given)

Exploitation status

CISA KEV added: 2026-10-27. Known ransomware campaign use: Not reported by CISA. Due date CISA set for US federal civilian agencies: 2026-11-10.

Scores

NVD CVSS 4.0: 9.2 CRITICAL; vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source [email protected].

EPSS by FIRST: 82.64%; percentile 99.67; score date 2026-10-31. EPSS estimates the probability of exploitation in the next 30 days.

CWE: CWE-252, CWE-787.

Timeline

Source events
DateEvent
2026-10-22T14:17:37.190NVD published
2026-10-27CISA KEV added
2026-10-30T20:30:11.670NVD last modified
2026-10-31FIRST EPSS score
2026-11-10CISA KEV due

CISA required action

“Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” — CISA KEV

What to do

  • Confirm whether you run Google Brotli and which version.
  • Apply the vendor update or mitigation in the vendor advisory.
  • Follow CISA’s required action.
  • Review the vendor guidance on signs of compromise.
  • Track the fix through completion.

References

Sources and dates

CISA Known Exploited Vulnerabilities Catalog, version 2026.10.30; retrieved 2026-11-01. CISA KEV data: CC0 1.0. No endorsement by CISA.

NVD retrieved: 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.

EPSS scores by FIRST; score date 2026-10-31.

Check your own domain's public security settings

The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for this CVE.

Check your own domain's public security settingsBook a scoping call