Detect Google Brotli Decoder Buffer Overflow Crash and Malformed Stream Exploitation (CVE-2026-111497) in Microsoft Sentinel
Detects exploitation of CVE-2026-111497, an unchecked return value leading to an out-of-bounds write (CWE-252, CWE-787) in the Brotli decoder (c/dec/decode.c) of Google Brotli 1.0.3 through 1.2.0, and in the many products that embed it (Node.js, .NET, Python brotlicffi, Envoy, Istio, DuckDB, ClickHouse, Apache Arrow and Siemens products). A remote attacker can send a crafted Brotli-compressed stream to corrupt adjacent decoder memory, leak data, crash the process or potentially run code. The CVE is on the CISA KEV catalog (added 2026-10-27, BOD 26-04). Detection focuses on what hosts and log pipelines can show: segfault or application-crash events from processes that decode untrusted Brotli data (web servers, proxies, Node.js and .NET services), repeated worker restarts, and clients sending Brotli-encoded request bodies (Content-Encoding: br) to endpoints that do not normally receive them.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
// df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has_any ("segfault", "general protection", "traps:", "core dumped")
| where SyslogMessage has_any ("libbrotlidec", "libbrotli", "brotli", "node", "nginx", "envoy", "dotnet", "clickhouse")
| extend Process = extract(@"(\w[\w\.-]*)\[\d+\]: segfault", 1, SyslogMessage)
| summarize Crashes = count(), Processes = make_set(Process), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| order by Crashes descFlags Linux hosts where processes that link or embed Brotli segfault, the likely observable outcome of a malformed Brotli stream hitting CVE-2026-111497.
Data Sources
Required Tables
False Positives & Tuning
- Unrelated application bugs that crash the same service
- Out-of-memory or hardware faults reported as segfaults
- Fuzzing or load tests in lab environments
Other platforms for CVE-2026-111497
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.
- Test 1 Emit a stand-in segfault message to syslog (lab)
Expected signal: A syslog event containing segfault, node and libbrotlidec.
Response Playbook
Triage
- Identify the host and process that crashed, and confirm whether it links or bundles an affected Brotli build (1.0.3 to 1.2.0) or an embedding product listed in the NVD record.
- Check web, proxy and application logs just before the crash for Brotli-encoded request bodies (Content-Encoding: br) or unusual compressed payloads from one source.
- Check whether the crash matches a deployment, load test or known application bug.
Containment
- Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1, or to the patched release of each embedding product (Node.js, .NET, brotlicffi and others), and follow BOD 26-04 guidance.
- Until patched, block or strip Brotli-encoded request bodies at the edge for endpoints that do not need them.
- Restart crashed services under a least-privilege account and block the offending sources.
Evidence Collection
- Collect core dumps, kernel and service logs for each crash.
- Preserve reverse proxy, WAF and load balancer logs with request headers and sizes for the same window.
- Capture process trees and outbound connections from the affected host after the crash.
Escalation Criteria
- !Escalate to incident response if a crash is followed by a shell, new outbound connection or new file written by the service account.
- !Escalate on repeated crashes of the same service from one source.
- !Escalate if the affected service is internet-facing and unpatched.
Investigation Guide
Forensic Artifacts
- >
Core dumps and kernel segfault messages for the service - >
Reverse proxy and WAF logs with Content-Encoding headers - >
Process creation events for children of the service
Tuning Guidance
Exploitation of a library flaw leaves little beyond crashes, so treat these rules as low fidelity. Baseline normal crash rates per service, suppress deployment windows, and prioritise crashes that follow Brotli-encoded requests from a single source or that are followed by a shell child process. Patching every embedding product is the definitive fix.
Hunting Queries
Builds a daily per-host count of segfaults in Brotli-linked services so unusual crash bursts stand out after the 2026-10-22 disclosure.
// df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(14d) | where SyslogMessage has "segfault" | where SyslogMessage has_any ("brotli", "node", "nginx", "envoy", "dotnet") | summarize Crashes = count() by Computer, bin(TimeGenerated, 1d) | order by Computer asc, TimeGenerated asc``` df00tech DF00-99403ee0b8 · https://df00tech.com/detections/CVE-2026-111497 · licence: https://df00tech.com/detections/licence ```
index=os segfault (brotli OR node OR nginx OR envoy OR dotnet) earliest=-14d | timechart span=1d count by hostAtomic Red Team Tests
Simulates the telemetry the log rules key on by writing a kernel-style segfault message for a Node.js process to the local syslog on a Linux lab host. This does not exploit the vulnerability. Run only on a lab host.
Command
logger -t kernel "node[4242]: segfault at 0 ip 00007f0000000000 sp 00007ffd00000000 error 4 in libbrotlidec.so.1[7f0000000000+10000]"Cleanup
echo "no cleanup required"Expected Telemetry
A syslog event containing segfault, node and libbrotlidec.
Expected Detection
The KQL, SPL and Sumo rules match on the message text; this test exercises the field mapping only.