Microsoft advisory: Google Brotli decoder out-of-bounds write allows remote code execution (CVE-2026-111497)

What happened

An out-of-bounds write in the Brotli decoder can be triggered by a crafted Brotli-compressed stream. Because the vulnerable path is reached over the network with no credentials and no user interaction, an attacker who can deliver compressed data to a service that decodes it can corrupt adjacent decoder state, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.

CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on 2026-10-27, with a due date of 2026-11-10. CISA's SSVC assessment records exploitation as active, and ENISA EUVD records exploitation since 2026-10-27. The CVSS 4.0 score is 9.2 (critical).

Who is affected

The affected library versions are Brotli 1.0.3 to before 1.0.10, Brotli 1.1.0 to before 1.1.1, and Brotli 1.2.0 to before 1.2.1. Microsoft's advisory notes that the flaw affects Node.js 26.x, 24.x and 22.x. The vulnerable component is the Brotli decoder, so exposure exists wherever an affected Brotli library or binary handles attacker-influenced compressed data.

What to do now

1. Update the Brotli library to a fixed release: 1.0.10, 1.1.1 or 1.2.1, depending on the branch in use.
2. Apply the relevant product update from the advisory. Advisory-listed fixed builds include 1.2.1-1, 8.0.427 — KB5133964, 9.0.320 — KB5133965, 10.0.403 — KB5133966, 11.0.100-rc.3.26522.148, 16.11.61, 17.14.43, 18.11.2, 18.12 Insiders 3, 7.6.9, 7.5.13, 7.4.22, 24.22.1-1, Prisma Cloud - Application Security Transporter Client >= 0.2.9, PAN-OS >= 12.2.4-h1, PAN-OS 11.1 >= 12.1.7-h11, PAN-OS 10.2 >= 11.2.7-h23, PAN-OS 10.2 >= 11.2.10-h17, PAN-OS 10.2 >= 11.2.13-h4, and PAN-OS 10.2 >= 11.2.16-h1.
3. For affected Node.js deployments, consult the Node.js October 2026 security releases.
4. Microsoft's advisory does not list workarounds, so patching is the primary control. CISA's KEV due date is 2026-11-10; before patching, review internet exposure and restrict access to affected services where possible.

How to detect it

No indicators of compromise are listed in Microsoft's advisory. Monitor services that decode Brotli-compressed input for crashes, decoder errors, or unusual memory usage; if such a service is internet-facing, treat it as exposed and prioritise patching or access restriction.

Beyond the patch

Because CISA KEV and ENISA record active exploitation, this is a case for detection and response rather than patching alone. Our Managed Detection & Response and Incident Response Retainer cover that. Where the Brotli decoder sits on an internet-facing service, a Virtual CISO Services review can map the exposure.