November 14, 2026

CVE Watchtower

CVE-2026-111497Google Brotli Out-of-bounds Write

NVD

Vulnerability Summary

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Severity Level
CRITICAL(9.2)
Published Date
Oct 22, 2026
Last Modified
Nov 10, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
82.64%Probability
Root Weakness (CWE)
CWE-787: Out-of-bounds Write ↗
The product writes data past the end, or before the beginning, of the intended buffer.
CWE-252 ↗
See the MITRE CWE entry for the full definition of this weakness.
CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsPresent
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None

Affected & Patched Versions

Affected Versions
  • Google Brotli >= 1.0.3 and < 1.0.10
  • Google Brotli >= 1.1.0 and < 1.1.1
  • Google Brotli >= 1.2.0 and < 1.2.1
Patched Versions
  • Google Brotli 1.0.10
  • Google Brotli 1.1.1
  • Google Brotli 1.2.1

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Nov 10, 2026.

  1. Check whether you run Google Brotli and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Oct 27, 2026
Remediation due: Nov 10, 2026 (deadline passed)

Timeline

  • Oct 22, 2026Published
  • Oct 27, 2026Added to CISA KEV catalog
  • Nov 10, 2026KEV remediation due date
  • Nov 10, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Google CVEsYou are reading CVE-2026-111497. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about Google CVEs

Related Coverage

External References

Data last checked: Nov 14, 2026 07:11 UTC