Google Brotli Memory Corruption Vulnerability (CVE-2026-111497)

Catalog analysis: CISA added this entry on October 27, 2026. The entry reflects catalog information retrieved on October 28, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-111497 is an unchecked return value vulnerability (CWE-252, CWE-787) within the Google Brotli compression library. A remote, unauthenticated attacker can exploit this by sending a specially crafted Brotli-compressed stream to a system utilizing the affected library. This flaw allows for the corruption of adjacent decoder state memory, which could lead to sensitive memory disclosure, denial of service (DoS), or potential remote code execution (RCE).

Exposure and applicability

Because Google Brotli is an open-source component, it is integrated into a wide variety of third-party products, applications, and protocols. Exposure exists wherever the library is used to decode compressed data from untrusted sources. Organizations must identify all assets—including cloud services and proprietary software—that embed this library as a dependency. The vulnerability’s inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog indicates that it is actively being leveraged in the wild, increasing the urgency for infrastructure owners to locate affected instances.

Remediation priorities

Our analysis suggests prioritizing remediation based on the asset’s internet exposure and its role in processing external data.

1. Update Library Version: The primary corrective action supported by the source is updating to Google Brotli version v1.2.1.
2. Dependency Mapping: Because this is a third-party library, vulnerability management teams should prioritize auditing Software Bills of Materials (SBOMs) or performing binary analysis to find embedded versions of Brotli that may not be immediately apparent through standard OS-level patching.
3. Edge Protection: For systems where immediate patching is not feasible, defenders should evaluate if existing edge controls can inspect or restrict compressed traffic patterns, though this is a temporary measure and not a replacement for the library update.

How to validate remediation

Verification must go beyond confirming a version number in a package manager. To ensure exposure is actually reduced, we recommend the following validation steps:

• Deployment Verification: Confirm that the updated library (v1.2.1) is not only installed on the disk but is actively loaded into memory by the running processes.
• Dependency Tree Audit: For compiled applications, verify that the final build artifact incorporates the patched version of the library rather than a statically linked older version.
• Configuration Review: Ensure that any third-party vendors providing managed services have confirmed the update of this specific component within their stack.

Limits and open questions

Updating to v1.2.1 addresses the unchecked return value, but residual risk remains if other undiscovered vulnerabilities exist in the Brotli decoder. Furthermore, because this is an integrated library, a version check on the host OS does not guarantee that all applications running on that host have been recompiled or updated with the fix. It remains unknown whether specific ransomware campaigns are utilizing this flaw, though its KEV status confirms general exploitation.

Source and editorial note

CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability · Source date: October 27, 2026 · Retrieved October 28, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment