CVE Details

CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
Published: 2026-10-27 CVSS: 9.2 CRITICAL Product: Google Brotli Due Date: 2026-11-10

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • 0xMarcio/pocindex • ⭐ 1499 • 2024-05-24 • Conf: 95.0%
  • Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
  • dimasma0305/CVE-2026-111497-POC • ⭐ 61 • 2026-10-22 • Conf: 98.0%
  • Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.2
  • Severity: CRITICAL
  • Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-111497
cveMetadata > assignerOrgId 14ed7db2-1595-443d-9d34-6215bf890778
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName Google
cveMetadata > dateReserved 2026-10-16T09:58:17.790Z
cveMetadata > datePublished 2026-10-22T13:35:41.975Z
cveMetadata > dateUpdated 2026-10-27T19:59:03.370Z
containers > cna > providerMetadata > orgId 14ed7db2-1595-443d-9d34-6215bf890778
containers > cna > providerMetadata > shortName Google
containers > cna > providerMetadata > dateUpdated 2026-10-27T14:58:42.704Z
containers > cna > title Out-of-Bounds Write in Google Brotli Decoder
containers > cna > datePublic 2026-02-27T07:50:00.000Z
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-787
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-787 Out-of-bounds Write
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > problemTypes > 1 > descriptions > 0 > lang en
containers > cna > problemTypes > 1 > descriptions > 0 > cweId CWE-252
containers > cna > problemTypes > 1 > descriptions > 0 > description CWE-252 Unchecked Return Value
containers > cna > problemTypes > 1 > descriptions > 0 > type CWE
containers > cna > impacts > 0 > capecId CAPEC-100
containers > cna > impacts > 0 > descriptions > 0 > lang en
containers > cna > impacts > 0 > descriptions > 0 > value CAPEC-100 Overflow Buffers
containers > cna > affected > 0 > vendor Google
containers > cna > affected > 0 > product Brotli
containers > cna > affected > 0 > packageName github.com/google/brotli
containers > cna > affected > 0 > repo https://github.com/google/brotli
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 1.0.3
containers > cna > affected > 0 > versions > 0 > lessThan 1.0.10
containers > cna > affected > 0 > versions > 0 > versionType semver
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 1.1.0
containers > cna > affected > 0 > versions > 1 > lessThan 1.1.1
containers > cna > affected > 0 > versions > 1 > versionType semver
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 1.2.0
containers > cna > affected > 0 > versions > 2 > lessThan 1.2.1
containers > cna > affected > 0 > versions > 2 > versionType semver
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value <p>A buffer overflow vulnerability in the Brotli decoder (<code>c/dec/decode.c</code>) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.<br><br></p><p>Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.<span></span></p>
containers > cna > references > 0 > url https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
containers > cna > references > 0 > tags > 0 patch
containers > cna > references > 1 > url https://github.com/andybalholm/brotli/releases/tag/v1.2.7
containers > cna > references > 1 > tags > 0 release-notes
containers > cna > references > 1 > tags > 1 third-party-advisory
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV4_0 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV4_0 > attackRequirements PRESENT
containers > cna > metrics > 0 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subConfidentialityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subIntegrityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subAvailabilityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > exploitMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > version 4.0
containers > cna > metrics > 0 > cvssV4_0 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV4_0 > baseScore 9.2
containers > cna > metrics > 0 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
containers > cna > solutions > 0 > lang en
containers > cna > solutions > 0 > value Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
containers > cna > solutions > 0 > supportingMedia > 0 > type text/html
containers > cna > solutions > 0 > supportingMedia > 0 > base64 False
containers > cna > solutions > 0 > supportingMedia > 0 > value Update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
containers > cna > credits > 0 > lang en
containers > cna > credits > 0 > value OpenAI Codex Security - Khai Tran and Sylvie Mayer
containers > cna > credits > 0 > type finder
containers > cna > source > discovery EXTERNAL
containers > cna > x_generator > engine Vulnogram 1.0.2
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-111497
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-27T19:53:21.238552Z
containers > adp > 0 > references > 0 > url https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/
containers > adp > 0 > references > 0 > tags > 0 third-party-advisory
containers > adp > 0 > references > 1 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
containers > adp > 0 > references > 1 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-27T19:59:03.370Z
containers > adp > 1 > providerMetadata > orgId af854a3a-2127-422b-91ae-364da2661108
containers > adp > 1 > providerMetadata > shortName CVE
containers > adp > 1 > providerMetadata > dateUpdated 2026-10-26T18:10:34.928Z
containers > adp > 1 > references > 0 > url https://github.com/advisories/GHSA-9v8h-qqgm-4m35
containers > adp > 1 > references > 1 > url http://www.openwall.com/lists/oss-security/2026/10/23/25
containers > adp > 1 > references > 2 > url https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html
containers > adp > 1 > references > 3 > url http://www.openwall.com/lists/oss-security/2026/10/24/6
containers > adp > 1 > references > 4 > url http://www.openwall.com/lists/oss-security/2026/10/26/12
containers > adp > 1 > references > 5 > url http://www.openwall.com/lists/oss-security/2026/10/26/13
containers > adp > 1 > references > 6 > url https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
containers > adp > 1 > references > 7 > url https://broccoli2shell.com
containers > adp > 1 > references > 8 > url https://github.com/dotnet/announcements/issues/494
containers > adp > 1 > references > 9 > url https://github.com/google/brotli/releases/tag/v1.2.1
containers > adp > 1 > references > 10 > url https://github.com/google/brotli/releases/tag/v1.1.1
containers > adp > 1 > references > 11 > url https://github.com/google/brotli/releases/tag/v1.0.10
containers > adp > 1 > references > 12 > url https://patchtheplanet.org/brotli
containers > adp > 1 > references > 13 > url http://www.openwall.com/lists/oss-security/2026/10/26/16
containers > adp > 1 > title CVE Program Container
containers > adp > 1 > x_generator > engine ADPogram 0.0.1