- Technical severity
- CRITICAL (9.2)
- Exploitation
- confirmed-in-the-wild-by-authority
- Exposure
- company-applicability-unknown
- Response priority
- urgent
- Analytical confidence
- high
Assessment
CVE-2026-111497 affects Google Brotli. CISA has confirmed inclusion in its known-exploited catalog. DualScope assigns urgent response priority under the stated generic context; each company should recalculate that priority from actual inventory, exposure and compensating controls.
Evidence and claims
- confirmed: CISA lists CVE-2026-111497 in the Known Exploited Vulnerabilities catalog.
- attributed: NVD reports CVSS 9.2 (CRITICAL); this measures technical severity, not company-specific risk.
- attributed: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- attributed: FIRST EPSS estimates a 88.0% probability of exploitation activity in the model window; this is a model estimate, not direct observation.
Company action plan
immediate · urgent
Vulnerability management / asset owners
Applies when: The organization uses Google Brotli; prioritize internet-facing instances.
Action: Identify affected deployments and compare installed versions with the vendor advisory or supported fixed release. Where applicable to the organization, consult CISA KEV required actions and deadlines; federal directives do not automatically impose obligations on every reader.
Dependencies: Authoritative asset inventory, product ownership and vendor advisory access.
Verify: Export the matched inventory with version and exposure evidence; have the service owner confirm false positives.
Residual risk: Unknown or unmanaged assets may remain exposed.
near-term · urgent
Platform operations / change management
Applies when: An affected version is confirmed.
Action: Apply the vendor-supported fix or documented mitigation through normal emergency change controls. Preserve rollback and configuration backups.
Dependencies: Vendor fix guidance, maintenance window and tested rollback.
Verify: Re-scan the deployed version and validate service health and security-control telemetry after the change.
Residual risk: Remediation does not establish that prior compromise did not occur.
investigation · urgent
Detection engineering / incident response
Applies when: The vulnerable service was reachable during the exposure window or suspicious activity exists.
Action: Review vendor-recommended indicators and relevant authentication, process, network and administrative logs. Escalate anomalies under the incident-response plan.
Dependencies: Retained logs and vendor-supported detection guidance. Do not treat generic IP blocklists as proof.
Verify: Document query scope, time range, data gaps and investigation outcome separately from patch status.
Residual risk: Absence of observed indicators is not proof of absence when telemetry is incomplete.
What remains uncertain
- Company deployment and internet exposure are unknown.
What would change this assessment
- A vendor advisory changes affected or fixed versions.
- An authoritative source changes the CVE status or exploitation assessment.
- New direct incident evidence changes the known attack prerequisites or impact.
Sources and methodology
- cisa-kev · retrieved October 28, 2026
- nvd-cve · retrieved October 28, 2026
- first-epss · retrieved October 28, 2026
DualScope uses deterministic automated analysis of public sources. It does not claim firsthand testing, private telemetry or interviews.