UBUNTU-CVE-2026-111497

Dashboard / Vulnerabilities / UBUNTU-CVE-2026-111497

UBUNTU-CVE-2026-111497

Summary:

Details: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

References: https://ubuntu.com/security/CVE-2026-111497, https://www.cve.org/CVERecord?id=CVE-2026-111497, https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148, https://github.com/dotnet/announcements/issues/494, https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates, https://ubuntu.com/security/notices/USN-8956-1, https://ubuntu.com/security/notices/USN-8956-2, https://ubuntu.com/security/notices/USN-8958-1