CVE-2026-111497 - Google Brotli Unchecked Return Value Vulnerability
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- Severity
- critical
- Product
- Google Brotli
- Published
- 2026-10-27
- EPSS
- 0.88
- CISA KEV
- Known exploited
- Ransomware
- Known campaign use
References and validation
- https://github.com/search?q=CVE-2026-111497&type=repositories
- https://nvd.nist.gov/vuln/detail/CVE-2026-111497
Entries are refreshed from CISA KEV and FIRST EPSS. Validate applicability before testing.