Skip to content
CVE-2026-111497

Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497)

Initial Access Execution Last updated:

Detects exploitation of CVE-2026-111497, an unchecked return value leading to an out-of-bounds write (CWE-252, CWE-787) in the Brotli decoder (c/dec/decode.c) of Google Brotli 1.0.3 through 1.2.0, and in the many products that embed it (Node.js, .NET, Python brotlicffi, Envoy, Istio, DuckDB, ClickHouse, Apache Arrow and Siemens products). A remote attacker can send a crafted Brotli-compressed stream to corrupt adjacent decoder memory, leak data, crash the process or potentially run code. The CVE is on the CISA KEV catalog (added 2026-10-27, BOD 26-04). Detection focuses on what hosts and log pipelines can show: segfault or application-crash events from processes that decode untrusted Brotli data (web servers, proxies, Node.js and .NET services), repeated worker restarts, and clients sending Brotli-encoded request bodies (Content-Encoding: br) to endpoints that do not normally receive them.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Google
Product
Brotli
Versions
Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1), Embedding products include Node.js, Python brotlicffi before 1.2.1.0 and Microsoft .NET; see each vendor advisory

Weakness (CWE)

CWE-252CWE-787

Timeline

Disclosed
October 22, 2026

CVSS

9.8
Critical (9.0–10)
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What is CVE-2026-111497 Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497)?

Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497) (CVE-2026-111497) maps to the Initial Access and Execution tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497), covering the data sources and telemetry it touches: Syslog, Linux kernel messages. The queries below are rated high severity at low confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution
Microsoft Sentinel / Defender
kusto 
// df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has_any ("segfault", "general protection", "traps:", "core dumped")
| where SyslogMessage has_any ("libbrotlidec", "libbrotli", "brotli", "node", "nginx", "envoy", "dotnet", "clickhouse")
| extend Process = extract(@"(\w[\w\.-]*)\[\d+\]: segfault", 1, SyslogMessage)
| summarize Crashes = count(), Processes = make_set(Process), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| order by Crashes desc

Flags Linux hosts where processes that link or embed Brotli segfault, the likely observable outcome of a malformed Brotli stream hitting CVE-2026-111497.

high severity low confidence

Data Sources

Syslog Linux kernel messages

Required Tables

Syslog

False Positives

  • Unrelated application bugs that crash the same service
  • Out-of-memory or hardware faults reported as segfaults
  • Fuzzing or load tests in lab environments

Query fingerprint DF00-99403ee0b8 · licence

Sigma logsource & community rules

The detection logic for Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497) (CVE-2026-111497) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-111497 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-111497

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Research depth: standard
References (3)

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Emit a stand-in segfault message to syslog (lab)

    Expected signal: A syslog event containing segfault, node and libbrotlidec.

Response Playbook

Triage

  1. Identify the host and process that crashed, and confirm whether it links or bundles an affected Brotli build (1.0.3 to 1.2.0) or an embedding product listed in the NVD record.
  2. Check web, proxy and application logs just before the crash for Brotli-encoded request bodies (Content-Encoding: br) or unusual compressed payloads from one source.
  3. Check whether the crash matches a deployment, load test or known application bug.

Containment

  1. Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1, or to the patched release of each embedding product (Node.js, .NET, brotlicffi and others), and follow BOD 26-04 guidance.
  2. Until patched, block or strip Brotli-encoded request bodies at the edge for endpoints that do not need them.
  3. Restart crashed services under a least-privilege account and block the offending sources.

Evidence Collection

  1. Collect core dumps, kernel and service logs for each crash.
  2. Preserve reverse proxy, WAF and load balancer logs with request headers and sizes for the same window.
  3. Capture process trees and outbound connections from the affected host after the crash.

Escalation Criteria

  • ! Escalate to incident response if a crash is followed by a shell, new outbound connection or new file written by the service account.
  • ! Escalate on repeated crashes of the same service from one source.
  • ! Escalate if the affected service is internet-facing and unpatched.

Investigation Guide

Forensic Artifacts

  • > Core dumps and kernel segfault messages for the service
  • > Reverse proxy and WAF logs with Content-Encoding headers
  • > Process creation events for children of the service

Tuning Guidance

Exploitation of a library flaw leaves little beyond crashes, so treat these rules as low fidelity. Baseline normal crash rates per service, suppress deployment windows, and prioritise crashes that follow Brotli-encoded requests from a single source or that are followed by a shell child process. Patching every embedding product is the definitive fix.

Hunting Queries

Builds a daily per-host count of segfaults in Brotli-linked services so unusual crash bursts stand out after the 2026-10-22 disclosure.

Hunting — KQL
kql 
// df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(14d) | where SyslogMessage has "segfault" | where SyslogMessage has_any ("brotli", "node", "nginx", "envoy", "dotnet") | summarize Crashes = count() by Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc
Hunting — SPL
spl 
``` df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence ```
index=os segfault (brotli OR node OR nginx OR envoy OR dotnet) earliest=-14d | timechart span=1d count by host

Atomic Red Team Tests

Test 1 Emit a stand-in segfault message to syslog (lab)
linux

Simulates the telemetry the log rules key on by writing a kernel-style segfault message for a Node.js process to the local syslog on a Linux lab host. This does not exploit the vulnerability. Run only on a lab host.

Command

bash 
logger -t kernel "node[4242]: segfault at 0 ip 00007f0000000000 sp 00007ffd00000000 error 4 in libbrotlidec.so.1[7f0000000000+10000]"

Cleanup

bash 
echo "no cleanup required"

Expected Telemetry

A syslog event containing segfault, node and libbrotlidec.

Expected Detection

The KQL, SPL and Sumo rules match on the message text; this test exercises the field mapping only.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0002 Execution ATT&CK Matrix

Related Techniques

T1190 Exploit Public-Facing Application T1203 Exploitation for Client Execution T1499 Endpoint Denial of Service

Same Tactic: Initial Access

Popular Detections

Browse by tactic

Full ATT&CK matrix Search all detections