9.2
Critical
Exploited
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-787, CWE-252
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Brotli 1.2 | 1.2.0 → < 1.2.1 | 1.2.1 |
| Brotli 1.1 | 1.1.0 → < 1.1.1 | 1.1.1 |
| Brotli 1.0 | 1.0.3 → < 1.0.10 | 1.0.10 |
| Cloud Connector Configurator | Versions not published | |
| Common Configurator (CC on IEM) | Versions not published | |
| Common Configurator on Device (CC on Edge) | Versions not published | |
| Data Flow Monitoring | Versions not published | |
| Databus Configurator | Versions not published | |
| Edge OPC UA Server Configurator | Versions not published |
Show the 14 other branches Hide the 14 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Flow Creator Configurator | Versions not published | |
| Industrial Edge Hub | Versions not published | |
| Industrial Edge Management Cloud | Versions not published | |
| RUGGEDCOM APE1808 | Versions not published | |
| Heliox Dual Port 60kW | Versions not published | |
| Heliox Flex Pro | Versions not published | |
| SICHARGE FLEX | Versions not published | |
| SICHARGE UC | Versions not published | |
| Sifinity Go | Versions not published | |
| Sifinity Setup | Versions not published | |
| VersiCharge AC Series | Versions not published | |
| VersiCloud | Versions not published | |
| Desigo CC family V8 | Versions not published | |
| Desigo CC family V9 | Versions not published |
References
- nodejs.org nodejs.org
- github.com github.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified