---
cve: "CVE-2026-111497"
severity: "CRITICAL"
cvss: 9.2
epss: "36%"
vendor: "Google"
kev: false
exploited: false
published: "2026-10-22 14:17:37"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T18:46:22+01:00"
---

# CVE-2026-111497

> 9.2 CRITICAL

## Beschreibung

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.





Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Google**
- State: PUBLISHED
- Stand: 2026-10-27 14:58:42
- CNA-CVSS: **9.2** (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-252** — Unchecked Return Value
  The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
- **CWE-787** — Out-of-bounds Write
  The product writes data past the end, or before the beginning, of the intended buffer.

## Patch verfügbar (OSV)

- db24a98aed38a16de78cc05ca15cdd8dc2a0d92d
- db0631dfea829194206d269bc7b25d0908cdb97d

## Referenzen

- <https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high>
- <https://github.com/andybalholm/brotli/releases/tag/v1.2.7>
- <http://www.openwall.com/lists/oss-security/2026/10/23/25>
- <http://www.openwall.com/lists/oss-security/2026/10/24/6>
- <http://www.openwall.com/lists/oss-security/2026/10/26/12>
- <http://www.openwall.com/lists/oss-security/2026/10/26/13>
- <http://www.openwall.com/lists/oss-security/2026/10/26/16>
- <https://broccoli2shell.com>
- <https://github.com/advisories/GHSA-9v8h-qqgm-4m35>
- <https://github.com/dotnet/announcements/issues/494>
- <https://github.com/google/brotli/releases/tag/v1.0.10>
- <https://github.com/google/brotli/releases/tag/v1.1.1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-111497/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_