Short answer: Users should update to the latest version to mitigate the risk.
TL;DR
- Critical vulnerability in Brotli decoder.
- Affects versions 1.0.3 through 1.2.0.
- Users should update to latest version.
- Can cause denial of service or execute arbitrary code.
What is CVE-2026-111497?
This is a critical buffer overflow vulnerability in the Brotli decoder, affecting versions 1.0.3 through 1.2.0. A remote unauthenticated attacker could exploit this to corrupt memory, cause a denial of service, or even execute arbitrary code. Users are advised to update their Brotli libraries to the latest available version (1.0.10, 1.1.1, or 1.2.1) to mitigate the risk.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Patch
- A software update from the maker that fixes a security weakness.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | Help Net Security |
|---|---|
| Date reported | 04 Nov 2026 |
| CVE | CVE-2026-111497 |
| CVSS | 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Weakness | CWE-252 (see NVD), CWE-787 (out-of-bounds write) |
| CISA KEV | Yes, added 2026-10-27; federal due date 2026-11-10 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | github.com |
| Affected product | Google Brotli |
| Published in NVD | 2026-10-22 (CVE-2026-111497) |
How it works
This file overflows a buffer, corrupting nearby memory and potentially letting the attacker run harmful code or crash the system. Impart uses AI to quickly create patches without risking production.
- Attacker reaches the Google Brotli over the internet / network
- No login or account is needed
- Sends crafted input that triggers the out-of-bounds write flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-10-22 | CVE-2026-111497 published in NVD | NVD |
| 2026-10-27 | CVE-2026-111497 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-11-04 | Reported by Help Net Security | Help Net Security |
| 2026-11-09 | This Skillmate explainer published | Skillmate |
| 2026-11-10 | US federal agencies must patch by this date | CISA KEV |
How to fix it
- Update Google Brotli to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-111497 and upgrade to the fixed release it lists.
- CVE-2026-111497 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders look for crashes or unusual logins.
What is confirmed
- CVE-2026-111497 is a real NVD record scored 9.2 CRITICAL
- CISA lists CVE-2026-111497 as exploited in the wild
- Reported by Help Net Security
- Reported by github.com
Why it matters
A patch may take weeks, but Impart can provide a patch in 60 minutes. Companies and users need quick, safe defense against threats. Students learn how AI can help cybersecurity.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is a buffer overflow?
A buffer overflow happens when more data is written to a memory location than it can hold, potentially causing the program to crash or execute malicious code.
How can I protect against this vulnerability?
Update Brotli libraries to version 1.0.10, 1.1.1, or 1.2.1 to fix the vulnerability.
What is a virtual patch?
A virtual patch is a temporary fix applied to a system to protect it from known vulnerabilities until a permanent fix is available.
Sources
- Impart uses AI to build virtual patches without putting models in the traffic path (Help Net Security)
- Vendor advisory CVE-2026-111497 (github.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.