What happened
An unpatched vulnerability has been reported in Google Brotli that allows a remote unauthenticated attacker to manipulate decoder state memory by exploiting an unchecked return value. This flaw enables the attacker to cause multiple impacts, including corruption of adjacent memory, potential disclosure of sensitive memory contents, denial of service, or arbitrary code execution through crafted Brotli-compressed streams. The vulnerability is designated as CVE-2026-111497 and has been classified as critical in severity. Active exploitation of this flaw has been confirmed in the wild, highlighting its immediate threat to affected systems. This weakness is associated with CWE-252 (Unchecked Return Value) and CWE-787 (Out-of-bounds Write), which underpin the memory corruption risks involved in the exploitation process. Recipients are urged to implement mitigations in line with vendor instructions. These actions are advised to follow the guidance set forth by CISA’s BOD 26-04 prioritising security updates based on risk, alongside the “Forensics Triage Requirements”. Where applicable, it is recommended to discontinue use of the product if timely mitigations cannot be applied. Who is affected Multiple organisations running Google Brotli that process or serve Brotli-compressed data are potentially affected. The impact is particularly significant if systems are exposed to untrusted networks or handle unverified compressed streams, as these are the primary vectors for exploitation described in reports. All affected deployments should evaluate their internet exposure and apply the relevant mitigations at the earliest opportunity, in accordance with the guidance provided by relevant security authorities and vendors. Recommended actions
Apply mitigations according to the instructions provided by the vendor, ensuring compliance with the guidance outlined in CISA’s BOD 26-04 documentation. If mitigations are not available, consider discontinuing use of Google Brotli for the affected functions. Assess whether any exposed systems process untrusted Brotli-compressed streams or are accessible from untrusted networks, and implement controls to limit access where feasible. Particular attention should be given to prioritising security updates based on risk, following the deadlines established by authorities.
