Repository navigation
[C++] Bundled Brotli 1.0.9 is affected by CVE-2026-111497 (decoder out-of-bounds write) #55166
Description
CVE-2026-111497 is an out-of-bounds write in the Brotli C decoder (c/dec/decode.c, versions 1.0.3 through 1.2.0). A crafted stream can request an impossible block switch, which the decoder mistakes for "needs more input". It then writes past the end of an internal 8-byte buffer. GitHub rates it 9.2 (CVSS 4.0), and Node.js shipped fixes for it on 2026-10-21.
cpp/thirdparty/versions.txt pins ARROW_BROTLI_BUILD_VERSION=v1.0.9, and that version is used whenever Brotli is built as a bundled dependency. In those builds, reading a Parquet or IPC file that contains Brotli-compressed data passes the file's contents to the decoder, so a crafted file can trigger the bug. Builds that link a patched system Brotli aren't affected.
Upstream fixed this in Brotli 1.0.10, 1.1.1 and 1.2.1 (fix commit). Updating the bundled copy to v1.2.1, or applying that commit, resolves it. A patched copy is easy to recognise: its decode.h defines BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17).
References:
- Advisory: GHSA-9v8h-qqgm-4m35
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- Upstream release: https://github.com/google/brotli/releases/tag/v1.2.1
- Overview of affected software and bundled copies: https://broccoli2shell.com/
Activity