CVE-2026-111497
KEV EPSS 82.6%Working PoC, vendors patching, scanners deployed, no KEV yet but imminent exploitation signal.
What: Buffer overflow in Google Brotli decoder (versions 1.0.3–1.2.0) affecting all platforms; remote attacker can corrupt memory, disclose secrets, DoS, or achieve RCE via crafted compressed streams. CVSS 9.2 Critical.
Why it matters: Four days post-disclosure, active chatter from practitioners discussing real-world exposure in git-remote-https, NGINX, Node.js, Bun, Python, and Envoy. Vendors patching urgently; RCE demonstrated on Node.js build. Multiple free scanning tools deployed to assess exposure. High EPSS (0.98) signals imminent weaponization despite no KEV listing yet.
Where it's seen: Bluesky dominance (49 people discussing top trend); vendor advisories and patches available; vulnerability scanner rollouts (NodeGuard, 37audits) within days; engineers confirming attack vectors in curl/git toolchain; researcher PoC on Node.js.
RISK: CRITICAL — Buffer overflow in widely-deployed compression; RCE demonstrated; high EPSS; urgent patching across ecosystem.
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.