Google Brotli Unchecked Return Value Vulnerability
Google — Brotli
- Added to KEV catalog
- 27 October 2026
- Federal remediation due date
- 10 November 2026
- Weakness classification (CWE)
- CWE-252, CWE-787
AI Breakdown
What it is
Google Brotli compression libraries contain an unchecked return value vulnerability within the decoder component. A remote, unauthenticated attacker can exploit this flaw by delivering a specially crafted Brotli-compressed data stream. Successful exploitation allows the attacker to corrupt memory, expose sensitive data, trigger a denial of service, or potentially execute arbitrary code.
Why it matters
CISA has added this flaw to its Known Exploited Vulnerabilities catalog, confirming evidence of active exploitation, though specific ransomware campaign associations remain unknown. Because Brotli is widely implemented across all major platforms, unpatched systems are vulnerable to remote compromise and severe operational disruption. Federal agencies and organizations following CISA directives must remediate affected assets by November 10, 2026.
Recommended action
Identify and update all Brotli installations between versions 1.0.3 and 1.2.0 to fixed versions 1.0.10, 1.1.1, or 1.2.1. Evaluate internet-exposed assets and implement vendor mitigations following CISA BOD 26-04 guidance and forensic triage requirements. If suitable updates or mitigations are not available for affected systems or cloud services, discontinue product use.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111497
NVD Technical Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
More Google Vulnerabilities
Google Pixel Improper Authorization Vulnerability
Google Chromium V8 Out of Bounds Write Vulnerability
Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Dawn Use-After-Free Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services