9.2
Critical
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-787, CWE-252
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Brotli 1.2 | 1.2.0 → < 1.2.1 | 1.2.1 |
| Brotli 1.1 | 1.1.0 → < 1.1.1 | 1.1.1 |
| Brotli 1.0 | 1.0.3 → < 1.0.10 | 1.0.10 |
| Cloud Connector Configurator 1.24 | earliest → < 1.24.3 | 1.24.3 |
| Common Configurator (CC on IEM) | Versions not published | |
| Common Configurator on Device (CC on Edge) | Versions not published | |
| Data Flow Monitoring 3.0 | earliest → < 3.0.18 | 3.0.18 |
| Databus Configurator 4.0 | earliest → < 4.0.1 | 4.0.1 |
| Edge OPC UA Server Configurator 2.3 | earliest → < 2.3.10 | 2.3.10 |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Flow Creator Configurator 1.15 | earliest → < 1.15.1 | 1.15.1 |
| Industrial Edge Hub | Versions not published | |
| Industrial Edge Management Cloud | Versions not published | |
| RUGGEDCOM APE1808 | Versions not published | |
| Heliox Dual Port 60kW | Versions not published | |
| Heliox Flex Pro | Versions not published | |
| SICHARGE FLEX | Versions not published | |
| SICHARGE UC | Versions not published | |
| Sifinity Go | Versions not published | |
| Sifinity Setup | Versions not published | |
| VersiCharge AC Series | Versions not published | |
| VersiCloud | Versions not published | |
| Desigo CC family V8 | Versions not published | |
| Desigo CC family V9 | Versions not published | |
| DataXess Configurator 1.5 | earliest → < 1.5.7 | 1.5.7 |
| Gridscale X DSA 5.3 | 5.3 → < 5.4 | 5.4 |
| Gridscale X PSS®E 36.8 | earliest → < 36.8.0 | 36.8.0 |