要点
- CVE-2026-111497 是影响 brotli, brotlicffi, p7zip (7-zip) 的严重 (CVSS 9.8)漏洞。
- 已被实际利用：CISA 于 27/10/2026 将其加入 KEV 目录。
- 未来 30 天内被利用的概率（EPSS）：82.6%，高于 99.7% 的漏洞。
- 修复：升级到 1.2.1, 1.2.1.0, 1.2.7, 1.4.4 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| brotli PyPI | ≥ 1.0.3, < 1.2.1< 1.2.1
| 1.2.1
|
| brotlicffi PyPI | ≥ 1.0.3, < 1.2.1.0< 1.2.1.0
| 1.2.1.0
|
| p7zip | ≤ 16.02
| No fix yet |
| brotli | < 1.2.7
| 1.2.7
|
| bun | < 1.4.4
| 1.4.4
|
| arrow | = 27.0.0≤ 26.0.0
| No fix yet |
| clickhouse | ≤ 26.10.2.103
| No fix yet |
| duckdb | ≤ 2.0.0
| |
Description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
NVD description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free