Brotli decoder overflow leaks memory, RCE risk (CVE-2026-111497) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-111497 is a critical buffer overflow in the Google Brotli decoder (c/dec/decode.c) affecting versions 1.0.3 through 1.2.0 on all platforms, and it lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code with a crafted Brotli-compressed stream. Patched in 1.2.1 (also 1.0.10 and 1.1.1); update any embedded Brotli library immediately.

Overview

Brotli is a compression algorithm Google maintains and ships widely: browsers, web servers, CDNs, HTTP client libraries, and countless applications embed the reference C/C++ decoder. The bug lives in c/dec/decode.c, where the decoder mishandles certain length or state transitions while processing a compressed stream. When a target decodes a maliciously crafted Brotli stream, the write exceeds the intended buffer and lands in adjacent decoder state memory.

Because Brotli decoding is typically reachable over the network - think Content-Encoding: br on an HTTP response or a request body an application decompresses - an attacker needs no credentials and no user interaction. They only need the victim to decode attacker-supplied data. The CVSS 9.2 score reflects that: network vector, low complexity, no privileges, no interaction.

Impact

The consequences depend on how the decoder is reached:

• Memory disclosure. Corrupted decoder state can cause sensitive heap contents to leak into decompressed output, exposing secrets such as keys, tokens, or adjacent request data.
• Denial of service. A malformed stream can crash the decoder outright, taking down servers, proxies, or client processes.
• Potential code execution. In the worst case, controlled corruption of adjacent state can be steered toward arbitrary code execution. The public proof-of-concept demonstrates the overflow; reliable exploitation depends on the specific build, hardening flags, and memory layout.

Any service that decompresses untrusted Brotli data - web servers, API gateways, proxies, crawlers, mail scanners, and anything linking a bundled Brotli library - should be treated as exposed.

Remediation and Mitigation

1. Upgrade the Brotli library. Move to 1.2.1. If you are pinned to an older line, 1.1.1 or 1.0.10 carry the fix. Verify the version your application actually links, including statically compiled copies and transitive dependencies.
2. Audit embedded copies. Language runtimes, HTTP clients, load balancers, and container base images often vendor their own Brotli. Grep build manifests and SBOMs for brotli and confirm each instance.
3. Interim mitigation. Where you cannot patch immediately, disable Brotli decompression of untrusted data (reject or strip Content-Encoding: br at the edge) and avoid decompressing attacker-controlled payloads.
4. Harden builds. Compile with stack protection, ASLR, and modern allocator hardening to raise the bar for turning the overflow into code execution.

Security Insight

Brotli’s bug is a reminder that ubiquitous, low-level codecs are a systemic supply-chain risk: one overflow in a library nobody thinks about ships into browsers, servers, and embedded devices simultaneously. The disclosure also carries a familiar pattern of a public proof-of-concept arriving alongside the fix, compressing the patch window to days. Compare this to the recent Chrome V8 zero-day and the broader weekly threat roundup: decoder and parser bugs remain the workhorse of real-world exploitation, and organizations that inventory third-party libraries catch them faster than those that only track top-level vendors.

Further Reading

• Oracle PeopleSoft CVE-2026-35273 exploited, web shells
• Weekly Threat Roundup: Ivanti & Chrome Zero-Days (June 8-14)
• Chrome V8 zero-day CVE-2026-11645 exploited in wild
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs