A critical buffer overflow vulnerability has been identified in the Google Brotli decoder, affecting multiple versions of the Brotli compression library across all platforms.
Tracked as CVE-2026-111497, this vulnerability has been assigned a CVSS v4.0 score of 9.2 (Critical). Successful exploitation could allow an unauthenticated remote attacker to corrupt memory, disclose sensitive information, cause a denial of service (DoS), or potentially execute arbitrary code on affected systems.
CVE ID: CVE-2026-111497
Severity: Critical
CVSS v4.0 Score: 9.2
Affected Component: Google Brotli Decoder (c/dec/decode.c)
Vulnerability Type: Buffer Overflow (Out-of-Bounds Write)
Potential Impact: Remote Code Execution (RCE), Information Disclosure, Memory Corruption, and Denial of Service (DoS)
The following Google Brotli versions are affected:
Affected Versions | Fixed Versions |
1.0.3 – 1.0.9 | 1.0.10 |
1.1.0 | 1.1.1 |
1.2.0 | 1.2.1 |
The vulnerability exists in the Brotli decoder, which is responsible for decompressing Brotli-compressed data. By sending a specially crafted compressed stream to an application using a vulnerable decoder, an attacker could trigger memory corruption.
Since Brotli is widely used as a compression library and is integrated into various applications and software dependencies, systems using affected versions may be exposed to security risks.
Using ManageEngine Endpoint Central, you can deploy applicable vendor security updates. Initiate a database and deploy the applicable patch:
CVE ID | Patch ID | Patch Description | Platform |
CVE-2026-111497 | 45873 | Update for .NET Hosting (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45874 | Update for AspNet Core (x64) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45875 | Update for AspNet Core (x86) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45876 | Update for .NET Desktop Runtime (x64) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45877 | Update for .NET Desktop Runtime (x86) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45878 | Update for .NET Runtime (x64) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45879 | Update for .NET Runtime (x86) (8.0.33) (KB5133964) | Windows |
CVE-2026-111497 | 45880 | Update for .NET SDK (x86) (8.0.427) (KB5133964) | Windows |
CVE-2026-111497 | 45881 | Update for .NET SDK (x86) (8.0.133) (KB5133964) | Windows |
CVE-2026-111497 | 45882 | Update for .NET SDK (x64) (8.0.133) (KB5133964) | Windows |
CVE-2026-111497 | 45883 | Update for .NET SDK (x64) (8.0.427) (KB5133964) | Windows |
CVE-2026-111497 | 45884 | Update for .NET Hosting (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45885 | Update for AspNet Core (x64) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45886 | Update for AspNet Core (x86) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45887 | Update for .NET Desktop Runtime (x64) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45888 | Update for .NET Desktop Runtime (x86) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45889 | Update for .NET Runtime (x64) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45890 | Update for .NET Runtime (x86) (9.0.22) (KB5133965) | Windows |
CVE-2026-111497 | 45891 | Update for .NET SDK (x86) (9.0.320) (KB5133965) | Windows |
CVE-2026-111497 | 45892 | Update for .NET SDK (x64) (9.0.320) (KB5133965) | Windows |
CVE-2026-111497 | 45893 | Update for .NET SDK (x64) (9.0.123) (KB5133965) | Windows |
CVE-2026-111497 | 45894 | Update for .NET SDK (x86) (9.0.123) (KB5133965) | Windows |
CVE-2026-111497 | 45895 | Update for .NET Hosting (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45896 | Update for AspNet Core (x64) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45897 | Update for AspNet Core (x86) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45898 | Update for .NET Desktop Runtime (x64) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45899 | Update for .NET Desktop Runtime (x86) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45900 | Update for .NET Runtime (x64) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45901 | Update for .NET Runtime (x86) (10.0.14) (KB5133966) | Windows |
CVE-2026-111497 | 45902 | Update for .NET SDK (x64) (10.0.403) (KB5133966) | Windows |
CVE-2026-111497 | 45903 | Update for .NET SDK (x86) (10.0.403) (KB5133966) | Windows |
CVE-2026-111497 | 45904 | Update for .NET SDK (x86) (10.0.114) (KB5133966) | Windows |
CVE-2026-111497 | 45905 | Update for .NET SDK (x64) (10.0.114) (KB5133966) | Windows |
CVE-2026-111497 | 365826 | Node.js 22 (LTS) (MSI) (x64) (22.23.4) | Windows |
CVE-2026-111497 | 365827 | Node.js 24 (LTS) (MSI) (x64) (24.22.1) | Windows |
CVE-2026-111497 | 365828 | Node.js 26 (MSI) (x64) (26.12.1) | Windows |
CVE ID | Patch ID | Patch Description | Platform |
CVE-2026-111497 | 765538 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765539 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765540 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765541 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765542 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765543 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765544 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765545 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765546 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765547 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765548 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765549 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765550 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765551 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765552 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765553 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765554 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 765555 | lossless compression algorithm and format (command line utility) (USN-8956-1) | Ubuntu |
CVE-2026-111497 | 828683 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828684 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828685 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828686 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828687 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828688 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828689 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 828690 | brotli security update (DSA-6582-1) | Debian |
CVE-2026-111497 | 1686689 | Brotli-devel update (ELSA-2026-500512) | Oracle |
CVE-2026-111497 | 1686690 | Brotli-devel update (ELSA-2026-500512) | Oracle |
CVE-2026-111497 | 1686691 | Python3-brotli update (ELSA-2026-500512) | Oracle |
CVE-2026-111497 | 1686692 | Brotli update (ELSA-2026-500512) | Oracle |
CVE-2026-111497 | 1686693 | Brotli update (ELSA-2026-500512) | Oracle |
CVE-2026-111497 | 1686694 | Brotli update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686695 | Brotli update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686696 | Brotli-devel update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686697 | Brotli-devel update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686698 | Python3-brotli update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686699 | Libbrotli update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686700 | Libbrotli update (ELSA-2026-500513) | Oracle |
CVE-2026-111497 | 1686701 | Python3-brotli update (ELSA-2026-500514) | Oracle |
CVE-2026-111497 | 1686702 | Brotli-devel update (ELSA-2026-500514) | Oracle |
CVE-2026-111497 | 1686703 | Libbrotli update (ELSA-2026-500514) | Oracle |
CVE-2026-111497 | 1686704 | Brotli update (ELSA-2026-500514) | Oracle |
CVE-2026-111497 | 1686705 | Nodejs24 update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686706 | Nodejs24-libs update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686707 | Nodejs24-devel update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686708 | Nodejs24-docs update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686709 | Nodejs24-npm update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686710 | Nodejs24-full-i18n update (ELSA-2026-500515) | Oracle |
CVE-2026-111497 | 1686711 | Nodejs-npm update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686712 | Nodejs-full-i18n update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686713 | Nodejs update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686714 | Nodejs-devel update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686715 | Nodejs-libs update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686716 | Nodejs-docs update (ELSA-2026-500516) | Oracle |
CVE-2026-111497 | 1686717 | Nodejs update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686718 | Nodejs-docs update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686719 | Nodejs-nodemon update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686720 | Nodejs-packaging update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686721 | Nodejs-packaging-bundler update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686722 | V8-12.4-devel update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686723 | Npm update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686724 | Nodejs-libs update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686725 | Nodejs-full-i18n update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686726 | Nodejs-devel update (ELSA-2026-500517) | Oracle |
CVE-2026-111497 | 1686727 | Nodejs-libs update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686728 | V8-13.6-devel update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686729 | Nodejs-packaging update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686730 | Nodejs-nodemon update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686731 | Nodejs-packaging-bundler update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686732 | Nodejs-docs update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686733 | Npm update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686734 | Nodejs update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686735 | Nodejs-devel update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686736 | Nodejs-full-i18n update (ELSA-2026-500518) | Oracle |
CVE-2026-111497 | 1686737 | Nodejs-docs update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686738 | Nodejs-packaging-bundler update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686739 | V8-12.4-devel update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686740 | Nodejs-packaging update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686741 | Nodejs-nodemon update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686742 | Nodejs update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686743 | Nodejs-devel update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686744 | Nodejs-full-i18n update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686745 | Nodejs-libs update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686746 | Npm update (ELSA-2026-500519) | Oracle |
CVE-2026-111497 | 1686747 | Nodejs-devel update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686748 | Nodejs-packaging update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686749 | Nodejs-packaging-bundler update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686750 | Nodejs update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686751 | Nodejs-nodemon update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686752 | Npm update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686753 | Nodejs-docs update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686754 | V8-13.6-devel update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686755 | Nodejs-libs update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 1686756 | Nodejs-full-i18n update (ELSA-2026-500520) | Oracle |
CVE-2026-111497 | 3033662 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033663 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033664 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033665 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033666 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033677 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033678 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033679 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033680 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033681 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033682 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033683 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033710 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033711 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033712 | Important: brotli security update | Alma |
CVE-2026-111497 | 3033713 | Important: brotli security update | Alma |
CVE-2026-111497 | 3341853 | (RHSA-2026:90449) Important: brotli security update | Red Hat |
CVE-2026-111497 | 3341854 | (RHSA-2026:90449) Important: brotli security update | Red Hat |
CVE-2026-111497 | 3341855 | (RHSA-2026:90449) Important: brotli security update | Red Hat |
CVE-2026-111497 | 3341856 | (RHSA-2026:90449) Important: brotli security update | Red Hat |
We recommend prioritizing remediation of this critical vulnerability to minimize the risk of potential exploitation.