diff --git a/HISTORY.rst b/HISTORY.rst
index 757ac7e..7ae7680 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -1,9 +1,11 @@
 Changelog
 =========
 
-Unreleased
-----------
+1.2.1.0 (2026-10-21)
+--------------------
 
+- Upgraded libbrotli to v1.2.1, which remediates CVE-2026-111497, an
+  out-of-bounds write that permits remote code execution.
 - Changed one-shot ``decompress()`` and streaming ``Decompressor.process()`` /
   ``Decompressor.decompress()`` to raise ``brotlicffi.error`` for trailing bytes
   after a complete Brotli stream, including calls without an output limit.
diff --git a/libbrotli b/libbrotli
index e230f47..db24a98 160000
--- a/libbrotli
+++ b/libbrotli
@@ -1 +1 @@
-Subproject commit e230f474b87134e8c6c85b630084c612057f253e
+Subproject commit db24a98aed38a16de78cc05ca15cdd8dc2a0d92d
diff --git a/src/brotlicffi/__init__.py b/src/brotlicffi/__init__.py
index f7b564d..b7c99af 100644
--- a/src/brotlicffi/__init__.py
+++ b/src/brotlicffi/__init__.py
@@ -5,4 +5,4 @@
     Compressor, MODE_GENERIC, MODE_TEXT, MODE_FONT, error, Error
 )
 
-__version__ = "1.2.0.2"
+__version__ = "1.2.1.0"