CVE-2026-111497

● Known-exploited CRITICAL

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent de...

Affects 0 products across 4 vendors.

CVSS 3.19.8
CVSS v49.2
EPSS82.6%
Percentile100th
PatchUnknown
Known-exploited since2026-10-27
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-252: CWE-252
CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

◆ AI Analysis — automated analysis, not human-reviewed

A critical severity vulnerability (CVE-2026-111497) affects the target system. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory content...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-111497?
A critical severity vulnerability (CVE-2026-111497) affects the target system. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory content...
What is the CVSS score for CVE-2026-111497?
CVE-2026-111497 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 82.6%.
Is CVE-2026-111497 actively exploited?
Yes. CVE-2026-111497 is in the CISA known-exploited catalog (added 2026-10-27). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2026-111497?
Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high
What systems are affected by CVE-2026-111497?
CVE-2026-111497 affects Fortinet; Johnsoncontrols; Palo Alto Networks; Siemens.
Vulnerability Details
CVE IDCVE-2026-111497
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2026-10-22
Last Modified2026-11-03
ICS Relevance100%
Weakness (CWE)
CWE-252Out-of-Bounds Write
SourceNVD
Official Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductAffected Versions
Fortinet — —
Johnsoncontrols — —
Palo Alto Networks — —
Siemens — —
7-Zip P7Zip ≤ 16.02
Andybalholm Brotli < 1.2.7
Anthropic Bun < 1.4.4
Apache Arrow 27.0.0 ≤ 26.0.0
Clickhouse Clickhouse ≤ 26.10.2.103
Debian Debian Linux 12.0
Duckdb Duckdb ≤ 2.0.0
Envoyproxy Envoy < 1.37.8 ≥ 1.38.0, < 1.38.6 ≥ 1.39.0, < 1.39.3
Google Brotli ≥ 1.0.3, < 1.0.10 ≥ 1.1.0, < 1.1.1 ≥ 1.2.0, < 1.2.1
Istio Istio < 1.29.9 ≥ 1.30.0, < 1.30.6 ≥ 1.31.0, < 1.31.2
Mcmilk 7-Zip-Zstd ≤ 26.02-1.5.7-r2
Microsoft .Net 11.0.0 ≥ 8.0.0, < 8.0.33 ≥ 9.0.0, < 9.0.22 ≥ 10.0.0, < 10.0.14
Nodejs Node.Js < 22.23.4 ≥ 23.0.0, < 24.22.1 ≥ 25.0.0, < 26.12.1
Python-Hyper Brotlicffi < 1.2.1.0
Tianocore Edk2 ≤ 202608
Remediation
View Vendor Advisory →
Threat Intelligence
● Threat Intelligence Validated: November 2026 | Threat Age: 12 Days
CISA known-exploited● Active Exploitation Confirmed (added 2026-10-27)
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Fortinet
CVE-2005-3057 10.0 The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and ot... CVE-2026-26084 9.9 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug... CVE-2018-1352 9.8 A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to ex... CVE-2018-13379 9.8 An Improper Limitation of a Pathname to a Restricted Directory ("Path Travers... CVE-2021-24019 9.8 An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS...
View all Fortinet CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2026-111497 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →