CVE-2026-111497
Unchecked Return Value in Google Brotli. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 27 October 2026.
- Product
- Google Brotli
- Added to CISA's catalog
- Federal fix-by date
- , in 5 days
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
More from Google this year.
- CVE-2026-58704 Improper Authorization, added
- CVE-2026-87491 Out of Bounds Write, added
- CVE-2026-85046 Type Confusion, added
- CVE-2026-11645 Out-of-Bounds Read and Write, added
- CVE-2026-5281 Use-After-Free, added
- CVE-2026-3910 Improper Restriction of Operations Within the Bounds of a Memory Buffer, added
- CVE-2026-3909 Out-of-Bounds Write, added
- CVE-2026-2441 CSS Use-After-Free, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.