CVE intelligence

CVE-2026-111497

Vulnerability intelligence

Published Oct 22, 2026Sources checked Oct 25, 2026

9.2CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-111497 and is rated Critical severity with a CVSS score of 9.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 25, 2026

Vendor remediation details

Release Notes Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET. Install KB5133964. Install KB5133965. Install KB5133966.

Vendor-listed releases

8.0.427
9.0.320
10.0.403
11.0.100-rc.3.26522.148
16.11.61
17.14.43
18.11.2
18.12 Insiders 3
7.6.9
7.5.13
7.4.22

CISA KEVNot listedBased on the latest collected catalog

EPSS0.7%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-111497?

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Source: NVD