Exploited vulnerability

CVE-2026-111497

TLP:CLEAR

Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Facts

Vendor: Google
Product: Brotli
CVSS: 9.2
EPSS (probability of exploitation within 30 days): 82.6 %
On CISA's Known Exploited Vulnerabilities list since: 27 October 2026
First known exploitation: 26 October 2026
CISA's deadline for US federal agencies: 10 November 2026
Weakness: CWE-252
First seen by Risk Letters: 27 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD