CVE-2026-111497: Brotli Decoder Out-of-Bounds Write Enables RCE Across Multiple Platforms
CVE-2026-111497 is an out-of-bounds write in Brotli’s decoder that can lead to remote code execution. Inventory – Identify all systems that use Brotli.
brotli
3 stories
PHP Releases Second Windows Update in Five Days to Patch PHP Brotli Flaw
PHP releases a second Windows update within five days to patch the PHP Brotli flaw (CVE-2026-111497) that can enable memory corruption and code execution.
Brotli Decoder Memory Corruption Enables RCE in Node.js, Bun, Python and More
CVE-2026-111497 in Google’s Brotli decoder allows crafted data to overwrite memory, enabling RCE in Node.js, Bun, Python and other software.