En bref
- CVE-2026-111497 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant brotli, brotlicffi, p7zip (7-zip).
- Exploitée activement : la CISA l'a ajoutée au catalogue KEV le 27/10/2026.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 82.6%, plus élevée que 99.7% des vulnérabilités.
- Correctif : mettre à jour vers 1.2.1, 1.2.1.0, 1.2.7, 1.4.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| brotli PyPI | ≥ 1.0.3, < 1.2.1< 1.2.1
| 1.2.1
|
| brotlicffi PyPI | ≥ 1.0.3, < 1.2.1.0< 1.2.1.0
| 1.2.1.0
|
| p7zip | ≤ 16.02
| No fix yet |
| brotli | < 1.2.7
| 1.2.7
|
| bun | < 1.4.4
| 1.4.4
|
| arrow | = 27.0.0≤ 26.0.0
| No fix yet |
| clickhouse | ≤ 26.10.2.103
| No fix yet |
| duckdb | ≤ 2.0.0
| |
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
NVD description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free