Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA lists exploited Google Brotli flaw CVE-2026-111497

Original title: CISA KEV: Google Brotli Unchecked Return Value Vulnerability — Google Brotli (CVE-2026-111497)

CISA Known Exploited Vulnerabilities ()1 min read
Read at cisa.gov
Part of a story covered by 21 sourcesCISA lists exploited Brotli decoder flaw CVE-2026-111497Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A crafted Brotli stream can corrupt decoder memory, leak data, cause denial of service, or run code.

CISA added CVE-2026-111497, an unchecked return value flaw in Google Brotli, to its Known Exploited Vulnerabilities catalog. A remote unauthenticated attacker can use a crafted Brotli-compressed stream to corrupt adjacent decoder state, disclose memory, cause a denial of service, or potentially execute arbitrary code. Required action is to apply vendor mitigations under BOD 26-04, or discontinue use if mitigations are unavailable. The due date is November 10, 2026.

Unconfirmed: CISA lists known ransomware campaign use as unknown.

Key facts
  • The vulnerability is an unchecked return value in the Brotli decoder.
  • Attackers do not need to authenticate.
  • The federal due date in the KEV entry is November 10, 2026.
  • Known ransomware campaign use is listed as unknown.
Security assessment · AI, from the articleExploited in the wild

Impact: Memory corruption, disclosure, denial of service, or code execution

ProductAffected
Google Brotli—
What to do
  1. 1.Apply vendor mitigations in line with CISA BOD 26-04 by November 10, 2026.
  2. 2.Discontinue use of the product if mitigations are unavailable.
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111497
ATT&CK
T1190 Exploit Public-Facing Application
Tags
brotligooglekevmemory-corruptioncisa
Vendors
Google
Products
Brotli
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV

From the original article

1 min read at cisa.gov

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.