CRITICALCVSS 9.883% EPSSKEV — known exploited🧨 Public exploit (GreyNoise)
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Published 2026-10-22 · last modified 2026-11-10
| Vendor | Product |
|---|---|
| 7-zip | p7zip |
| andybalholm | brotli |
| anthropic | bun |
| apache | arrow |
| clickhouse | clickhouse |
| debian | debian_linux |
| duckdb | duckdb |
| envoyproxy | envoy |
| brotli | |
| woff2 | |
| istio | istio |
| mcmilk | 7-zip-zstd |
| microsoft | .net |
| nodejs | node.js |
| python-hyper | brotlicffi |
| siemens | common_configurator |
| siemens | comos_walkinside |
| siemens | data_flow_monitoring |
| siemens | dataxess_configurator |
| siemens | edge_opc_ua_server_configurator |
| siemens | flow_creator_configurator |
| siemens | hyperlynx |
| siemens | industrial_edge_cloud_connector_configurator |
| siemens | industrial_edge_databus_configurator |
| siemens | industrial_edge_hub |
| siemens | industrial_edge_management_cloud |
| siemens | innexis_architecture_native_acceleration |
| siemens | insights_hub |
| siemens | opcenter_connect_electronics |
| siemens | opcenter_connect_manufacturing_operations_management |
| siemens | opcenter_execution_core |
| siemens | opcenter_execution_discrete |
| siemens | opcenter_execution_foundation |
| siemens | opcenter_execution_pharma |
| siemens | opcenter_execution_process |
| siemens | opcenter_intelligence |
| siemens | opcenter_quality |
| siemens | opcenter_rd\&l |
| siemens | opcenter_x |
| siemens | pads_professional |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.