Tracker / CVE-2026-111497
CVE-2026-111497
Exploited Critical 9.8
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Affected products and versions
| 7-zip | p7zip · … → 16.02 |
|---|---|
| andybalholm | brotli · … → 1.2.7 |
| anthropic | bun · … → 1.4.4 |
| apache | arrow |
| apache | arrow · … → 26.0.0 |
| clickhouse | clickhouse · … → 26.10.2.103 |
| debian | debian_linux |
| duckdb | duckdb · … → 2.0.0 |
| envoyproxy | envoy · … → 1.37.8 |
| envoyproxy | envoy · 1.38.0 → 1.38.6 |
| envoyproxy | envoy · 1.39.0 → 1.39.3 |
| brotli · 1.0.3 → 1.0.10 | |
| brotli · 1.1.0 → 1.1.1 | |
| brotli · 1.2.0 → 1.2.1 | |
| woff2 | |
| istio | istio · … → 1.29.9 |
| istio | istio · 1.30.0 → 1.30.6 |
| istio | istio · 1.31.0 → 1.31.2 |
| mcmilk | 7-zip-zstd · … → 26.02-1.5.7-r2 |
| microsoft | .net |
| microsoft | .net · 10.0.0 → 10.0.14 |
| microsoft | .net · 8.0.0 → 8.0.33 |
| microsoft | .net · 9.0.0 → 9.0.22 |
| nodejs | node.js · … → 22.23.4 |
| nodejs | node.js · 23.0.0 → 24.22.1 |
| nodejs | node.js · 25.0.0 → 26.12.1 |
| python-hyper | brotlicffi · … → 1.2.1.0 |
| siemens | common_configurator |
| siemens | data_flow_monitoring |
| siemens | edge_opc_ua_server_configurator |
| siemens | flow_creator_configurator |
| siemens | industrial_edge_cloud_connector_configurator |
| siemens | industrial_edge_databus_configurator |
| siemens | industrial_edge_hub |
| siemens | industrial_edge_management_cloud |
| siemens | ruggedcom_ape1808_firmware |
| tianocore | edk2 · … → 202608 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.