Google Brotli Decoder Vulnerability CVE-2026-111497 Requires Immediate Updates

## Overview Google Brotli versions 1.0.3 through 1.2.0 contain a critical buffer overflow vulnerability. This affects all platforms using the Brotli decoder located in c/dec/decode.c. The CVSS score for this vulnerability is 9.2, indicating a high severity level. ## Technical Details The vulnerability allows a remote unauthenticated attacker to exploit the Brotli decoder. By sending a specially crafted Brotli-compressed stream, an attacker can corrupt adjacent decoder state memory. This corruption can lead to the disclosure of sensitive memory contents. Additionally, it may cause a denial of service or allow the execution of arbitrary code. ## Impact If exploited, this vulnerability poses significant risks to systems using affected versions of Brotli. Attackers could gain access to sensitive information or disrupt services. The potential for arbitrary code execution makes this vulnerability particularly dangerous, as it opens the door for further exploitation. ## Mitigation Defenders must update any Brotli libraries or binaries from versions 1.0.3 to 1.2.0 to the latest available versions: 1.0.10, 1.1.1, or 1.2.1. Immediate action is necessary to protect systems from potential exploitation.