CVE-2026-111497 Google Brotli
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause…
- CVSS
- 9.2 Critical
- EPSS
- 83%
- Percentile
- 100
- Published
- 2026-10-22
- Force
- 11 of 12
- Public PoC
- 88
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
Google Brotli Unchecked Return Value Vulnerability
- Added
- 2026-10-27
- Federal patch deadline
- 2026-11-10
- Ransomware use
- not known
In the news
- CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoderMicrosoft Security Update Guide · 2026-11-12
- Siemens Desigo, GridscaleCISA Advisories · 2026-11-12
- Siemens RUGGEDCOM APE1808CISA Advisories · 2026-11-12
- Siemens Industrial Edge ManagementCISA Advisories · 2026-11-12
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Advisories · 2026-10-27