Google Brotli Memory Corruption: Updates Explained
Published · Google · 1 CVE · NVD and CISA KEV checked October 30, 2026
In short Google Brotli has a critical decoder flaw known to be exploited. Learn which versions are affected and how to verify an update.
What happened
Google's Brotli has a memory corruption vulnerability in its decoder, the component that unpacks compressed data. Think of unpacking a suitcase: everything should stay inside its assigned space, but this flaw can let data spill into neighboring compartments. In software, that spill can damage memory used by the decoder.
The vulnerability, CVE-2026-111497, can be triggered by a specially prepared Brotli-compressed stream. An attacker does not need to authenticate, but the affected software must process the attacker's compressed data. Possible consequences include exposing sensitive memory contents, interrupting service, and potentially running code chosen by the attacker.
This vulnerability is known to be exploited: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-27. NVD published its entry on 2026-10-22, and KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-26. Google's advisory and NVD identify the vulnerability and the affected software; CISA KEV establishes its known exploitation status.
Technical details
The flaw is a buffer overflow in the Brotli decoder. A buffer is a reserved area of memory; an overflow occurs when a write extends beyond its intended boundary. Here, processing a crafted compressed stream can overwrite nearby memory holding the decoder's state, meaning information it uses to track the decompression operation. The description identifies potential memory disclosure, denial of service, and arbitrary code execution as consequences. Denial of service means disrupting availability, while arbitrary code execution means potentially running instructions supplied by an attacker.
NVD associates the vulnerability with CWE-252, Unchecked Return Value, and CWE-787, Out-of-bounds Write. An unchecked return value means software fails to inspect a result that could indicate an operation did not succeed as expected. An out-of-bounds write means software writes beyond the memory region it should use. These classifications identify relevant weaknesses, but the description does not explain the exact sequence connecting the unchecked result to the overflow.
The attack is described as remote and unauthenticated, and the flaw applies across platforms. The essential processing condition is that a vulnerable decoder receives a crafted Brotli-compressed stream. That does not establish that every application containing Brotli is reachable by an attacker: developers and administrators need to determine whether outside-supplied data can reach the decoder in their particular deployment.
NVD assigns a CVSS 4.0 score of 9.2 and a CRITICAL severity rating. CVSS, the Common Vulnerability Scoring System, expresses technical severity; it is not a prediction that a particular installation will be compromised. The score supports prioritizing remediation, while the separate CISA KEV listing establishes that exploitation is known to have occurred. Neither entry supplies details about the attackers or their methods beyond the described crafted stream.
Weakness types: Memory corruption
Who is affected
Everyday users
Everyday users may encounter Brotli as a component inside software rather than something they installed directly. The practical concern is whether an application uses an affected decoder to unpack data an attacker can influence. Depending on how that application uses Brotli, the reported consequences could include a crash, exposure of sensitive information held in memory, or potential execution of attacker-chosen code.
Use the update supplied for the application or software package that includes Brotli, and follow the update steps in the vendor's advisory. Updating a separately installed Brotli package does not establish that every application has updated its own included copy. If the component version is unclear, ask the application's maintainer whether its release includes a fix for CVE-2026-111497.
Developers
Developers should examine both direct dependencies and dependencies brought in by other components. Determine which Brotli decoder is actually included in the shipped application and whether it handles compressed data from outside a trusted boundary. A dependency list is a starting point; the deployed application may contain a separately bundled copy that also needs attention.
Use the exact affected ranges when deciding whether a dependency needs replacement. Brotli versions >= 1.0.3 and < 1.0.10 are affected, with 1.0.10 listed as the fix. Versions >= 1.1.0 and < 1.1.1 are affected, with 1.1.1 listed as the fix. Versions >= 1.2.0 and < 1.2.1 are affected, with 1.2.1 listed as the fix. Preserve these separate ranges in dependency reviews so a fixed release is not mistakenly treated as vulnerable.
Server and IT admins
Server and IT administrators should identify deployed software that uses Brotli decoding, then establish whether untrusted compressed input can reach it. Prioritize affected deployments with a reachable decoding path because this vulnerability is known to be exploited. The possible operational effects include service interruption and disclosure of memory contents, with code execution also described as a potential outcome.
CISA KEV lists 2026-11-10 as the due date for CVE-2026-111497. Treat that as the catalog's listed deadline, without assuming it defines every organization's requirements. The catalog records known ransomware use as Unknown; that leaves ransomware involvement unresolved and does not change the confirmed exploitation status.
What to do now
- Inventory the applications, libraries, and binaries in your environment that include Brotli. Record the version used by each deployed copy and whether it performs decoding.
- Compare each version with the affected ranges: >= 1.0.3 and < 1.0.10; >= 1.1.0 and < 1.1.1; or >= 1.2.0 and < 1.2.1. Keep the ranges separate when assessing exposure.
- Follow the update steps in the vendor's advisory. The listed fixed releases are 1.0.10, 1.1.1, and 1.2.1 for their respective affected ranges. For Brotli included inside another application, obtain the application's corresponding fixed package.
- Deploy the updated software wherever an affected copy is used. Developers should ensure that rebuilt application packages actually include the fixed dependency; administrators should confirm that the updated package reaches the running deployment.
- Prioritize affected decoders that process outside-supplied data, and track remediation against your organization's requirements. Include the CISA KEV addition on 2026-10-27 and its listed due date of 2026-11-10 in that review.
- After deployment, check the effective component version and exercise the application's normal Brotli decoding workflow. Record the fixed version and any remaining affected copies.
Check the Python brotli package version · official docs
pip show brotliHow to confirm the fix
- Confirm that the installed Brotli copy has moved from an affected range to its listed fixed release: 1.0.10, 1.1.1, or 1.2.1. For an application that bundles Brotli, confirm the included component through the maintainer's release information or package records.
- If you use the allowed Python package check, interpret its result only for the environment it inspects. It does not establish the versions of separately bundled Brotli libraries or binaries.
- Confirm that the deployed application is using the updated component, then test ordinary decompression behavior. A successful functional check helps verify that the update works, but it does not independently prove that the vulnerability is absent.
- Review the inventory again for affected copies left in other applications or deployments. Close the remediation task only after each identified copy has an accounted-for outcome.
NVD scores and CISA KEV status
Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-111497 (added October 27, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.
| CVE | CVSS | Severity | Weakness (CWE) | KEV |
|---|---|---|---|---|
| CVE-2026-111497 | 9.2 (v4.0) | Critical | CWE-252, CWE-787 | Listed |
Affected products and fixed versions 3 rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| Brotli | >= 1.0.3 and < 1.0.10 | 1.0.10 | CVE-2026-111497 |
| Brotli | >= 1.1.0 and < 1.1.1 | 1.1.1 | CVE-2026-111497 |
| Brotli | >= 1.2.0 and < 1.2.1 | 1.2.1 | CVE-2026-111497 |
The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.
Frequently asked questions
Is CVE-2026-111497 known to be exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-27. The catalog lists known ransomware use as Unknown, so ransomware involvement remains unresolved.
Which Brotli versions fix the vulnerability?
The listed fixes are 1.0.10 for affected versions >= 1.0.3 and < 1.0.10, 1.1.1 for affected versions >= 1.1.0 and < 1.1.1, and 1.2.1 for affected versions >= 1.2.0 and < 1.2.1. Follow the update steps in the vendor's advisory for the software you use.
Does having Brotli installed mean an attacker can immediately exploit my system?
Installation alone does not establish an exploitable path. The described attack requires a vulnerable decoder to process a crafted Brotli-compressed stream. Check the component version and whether attacker-controlled input can reach decoding. An affected copy still needs remediation even when its exposure is not yet clear.
References
- Google advisory: https://github.com/google/brotli/releases
- Google advisory: https://www.php.net/archive/2026.php#2026-10-26-1
- NVD: CVE-2026-111497
- CISA Known Exploited Vulnerabilities catalog
- Also reported by KISA (Korea Internet & Security Agency) on October 26, 2026: KISA advisory (Korean)
How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.