{"id":"CVE-2026-111497","title":"Out-of-Bounds Write in Google Brotli Decoder","summary":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive m…","severity":"critical","cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-787","CWE-252"],"vendor":"Google","product":"github.com/google/brotli","affected":["github.com/google/brotli >= 1.0.3 < 1.0.10","github.com/google/brotli >= 1.1.0 < 1.1.1","github.com/google/brotli >= 1.2.0 < 1.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-22T14:15:10.861688Z"},"exploitAvailable":true,"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T19:00:32.358Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111497","references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"}],"tags":["cve.org","exploit-available"],"exploits":{"github":9,"githubRepos":["https://github.com/CaterMaoZi/CVE-2026-111497-POC","https://github.com/dimasma0305/CVE-2026-111497-POC","https://github.com/Sami-AlEsh/nodejs-security-check"],"checkedAt":"2026-10-22T22:01:26.501Z"},"ingestedAt":"2026-10-22T22:00:50.377Z","slug":"CVE-2026-111497","body":"## Overview\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.\n\n## Affected\n\n- `github.com/google/brotli >= 1.0.3 < 1.0.10`\n- `github.com/google/brotli >= 1.1.0 < 1.1.1`\n- `github.com/google/brotli >= 1.2.0 < 1.2.1`\n\n## Remediation\n\nUpdate any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":50.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}