Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497 is a high-severity vulnerability in Google Brotli, an open-source compression library. The flaw involves an unchecked return value that can be exploited by a remote unauthenticated attacker via a crafted Brotli-compressed stream. Successful exploitation can lead to corruption of adjacent decoder state memory, disclosure of sensitive memory contents, denial of service, or potentially arbitrary code execution. Because Brotli is a widely used open-source component and third-party library, many products may be affected. CISA has flagged this vulnerability and references it under BOD 26-04, which prioritizes security updates based on risk. A patched version (v1.2.1) has been released by Google on GitHub. Organizations using Brotli in any capacity are urged to update to the latest version immediately. The vulnerability is tracked at NVD and has been assigned a High criticality rating.