Can Crafted Brotli Streams Execute Code in Google Decoder?

Google Brotli contains a critical buffer overflow vulnerability in its decoder component that enables remote code execution. According to the National Vulnerability Database, the flaw resides in the c/dec/decode.c file and affects versions 1.0.3 through 1.2.0. An attacker does not need authentication to exploit this weakness. By sending a specially crafted Brotli-compressed stream, a remote adversary can corrupt adjacent decoder state memory. This corruption allows the attacker to disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code on the affected system. The vulnerability is rated as critical with a CVSS score of 9.2.

By the numbers

• 9.2: The CVSS severity score assigned to CVE-2026-111497 by the National Vulnerability Database
• 1.0.3: The earliest affected version of the Google Brotli decoder library
• 1.2.0: The latest affected version of the Google Brotli decoder library before patches
• 1.0.10: The first patched version available for the 1.0.x branch of the library

What the figures mean

The high CVSS score reflects the ease with which an attacker can exploit this flaw without any prior access or credentials. The range of affected versions indicates that many systems currently in use are vulnerable, as the issue spans multiple minor releases. The availability of specific patch versions for three different branches suggests that users must verify their exact current version to apply the correct fix. The critical rating underscores the potential for full system compromise through arbitrary code execution, making immediate attention necessary for teams managing these libraries.

What to watch

Security teams should monitor their environments for any processes utilizing Brotli compression libraries within the affected version range. Analysts should look for unexpected memory corruption events or crashes in services that handle external compressed data inputs. Since the attack vector involves crafted streams, any service accepting user-supplied Brotli-compressed content is a potential target. Teams should verify that their deployment pipelines are not pulling in vulnerable library versions from package managers or container registries.

Infection and persistence in general

Malware campaigns targeting compression libraries often rely on tricking applications into processing maliciously crafted files. Attackers typically embed the exploit in common file formats or network protocols that use compression. Once the buffer overflow triggers, the malicious code gains execution privileges. Persistence mechanisms vary, but attackers often install backdoors or rootkits to maintain access. Analysts should examine memory dumps for anomalous code execution and check system integrity for unexpected changes in library files or binary configurations.

Background: Memory corruption vulnerabilities

Memory corruption occurs when software writes data outside its allocated memory space, overwriting adjacent variables or code. This allows attackers to hijack program execution, escalate privileges, or crash systems. It affects any application managing memory directly, including operating systems, browsers, and embedded devices. Prevention requires strict memory management and modern compiler protections.

Read the full guide: Memory Corruption Vulnerabilities: Definition, Mechanisms, and Mitigation

What to do and how to stay safe: Google Brotli

• Inventory all systems and applications that use Google Brotli libraries to identify those running versions 1.0.3 through 1.2.0
• Update affected systems to version 1.0.10, 1.1.1, or 1.2.1 as soon as possible to mitigate the risk
• Monitor network traffic and application logs for signs of abnormal behavior or crashes in services handling compressed data
• Validate that software supply chains are not reintroducing vulnerable library versions during deployment or updates

Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan

General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Google Brotli are affected by this vulnerability?

Versions 1.0.3 through 1.2.0 are affected across all platforms.

Is authentication required to exploit this buffer overflow?

No, the vulnerability allows a remote unauthenticated attacker to exploit it.

What are the recommended patched versions to resolve this issue?

Users should update to version 1.0.10, 1.1.1, or 1.2.1.