CVE-2026-111497: Google Brotli Buffer Overflow Leads to Remote Code Execution

Overview

CVE-2026-111497 is a critical buffer overflow vulnerability in Google Brotli’s decoder, affecting versions 1.0.3 through 1.2.0. A remote, unauthenticated attacker can exploit this flaw using a specially crafted Brotli-compressed stream, leading to memory corruption, sensitive data disclosure, denial of service, or potentially arbitrary code execution. This vulnerability is actively being exploited, as indicated by CISA’s confirmation of “PHP2Shell” exploitation.

Technical Analysis

• Vulnerability: Buffer overflow in the Brotli decoder (c/dec/decode.c). The NVD record also notes an unchecked return value (CWE-252) contributing to the issue, leading to an out-of-bounds write (CWE-787).
• Affected Versions: Google Brotli versions 1.0.3 through 1.2.0, across all platforms.
• Attack Vector: Remote, unauthenticated. Exploitation occurs via a crafted Brotli-compressed stream.
• Impact: Successful exploitation can lead to:
  • Corrupt adjacent decoder state memory.
  • Disclose sensitive memory contents.
  • Cause a denial of service (DoS).
  • Potentially execute arbitrary code (RCE).
• Exploitation: Publicly confirmed exploitation under the “PHP2Shell” moniker, indicating active abuse. Related community intelligence mentions “HTTP2Shell” and “Node2Shell” as well, suggesting broad applicability across different environments utilizing Brotli.

Detection

Detecting the initial exploitation of this library-level vulnerability can be challenging without deep packet inspection for malformed Brotli streams or specific application-level logging. However, successful exploitation leading to arbitrary code execution would likely manifest through post-exploitation activities.
* Process Creation Anomalies: Monitor for unusual child processes spawned by applications or services that utilize the Brotli library (e.g., web servers like Apache, Nginx, IIS, or applications like Node.js, PHP processes). Look for cmd.exe, powershell.exe, sh, bash, or other command interpreters executing from unexpected parent processes or with suspicious command-line arguments.
* File System Modifications: Look for new or modified files in web root directories, temporary directories, or system paths that could indicate webshells, malware drops (e.g., PolinRider), or persistence mechanisms.
* Network Connections: Monitor for outbound connections from vulnerable applications to unusual external IP addresses or domains, indicative of command-and-control (C2) communication or data exfiltration.
* Application Crashes: Monitor application logs for crashes, segmentation faults, or other memory-related errors that might indicate failed or successful exploitation attempts leading to denial of service.

Sigma Detection Rules

Brotli RCE – Web Server Spawns Shell

title: Brotli RCE - Web Server Spawns Shell
id: 342f0a1d-5b7e-4c8d-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects suspicious shell process creation by common web server or application processes, indicative of successful remote code execution via vulnerabilities like CVE-2026-111497.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\node.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: all of selection_parent and all of selection_child
level: critical

Brotli RCE – Suspicious Command Line from Web Process

title: Brotli RCE - Suspicious Command Line from Web Process
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious command-line arguments executed by web server or application processes, potentially indicating successful remote code execution from vulnerabilities like CVE-2026-111497.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\node.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_keywords:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'ipconfig'
      - 'curl '
      - 'wget '
      - 'certutil '
      - 'bitsadmin '
      - 'powershell -enc '
      - 'mshta '
      - 'regsvr32 '
      - 'sc.exe create'
      - 'schtasks /create'
  condition: all of selection_parent and all of selection_keywords
level: high

Mitigations

1. Patch Immediately: Update all instances of Google Brotli libraries or binaries to the latest available patched versions: 1.0.10, 1.1.1, or 1.2.1. Prioritize systems running versions 1.0.3 through 1.2.0.
2. Input Validation: Implement robust input validation and sanitization for any Brotli-compressed data processed by applications, though this is a workaround and not a full fix for the underlying library vulnerability.
3. Network Segmentation: Isolate critical applications that process untrusted Brotli-compressed data to limit potential lateral movement in case of compromise.
4. Least Privilege: Ensure applications and services running Brotli decoders operate with the minimum necessary privileges.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• https://github.com/andybalholm/brotli/releases/tag/v1.2.7
• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497—high
• http://www.openwall.com/lists/oss-security/2026/10/23/25
• http://www.openwall.com/lists/oss-security/2026/10/24/6
• http://www.openwall.com/lists/oss-security/2026/10/26/12
• http://www.openwall.com/lists/oss-security/2026/10/26/13
• http://www.openwall.com/lists/oss-security/2026/10/26/16
• https://broccoli2shell.com
• https://www.wiz.io/blog/php2shell-exploitation-so-far
• https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
• https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net
• https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/
• https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059 — Command and Scripting Interpreter
• T1499 — Endpoint Denial of Service
• T1003 — OS Credential Dumping
• T1537 — Transfer Data to Cloud Account
• T1133 — External Remote Services
• T1071 — Application Layer Protocol
• T1560 — Archive Collected Data
• T1595.002 — Vulnerability Scanning
• T1595 — Active Scanning
• T1212 — Exploitation for Credential Access
• T1059.004 — Unix Shell
• T1078 — Valid Accounts
• T1068 — Exploitation for Privilege Escalation
• T1027 — Obfuscated Files or Information
• T1573 — Encrypted Channel
• T1203 — Exploitation for Client Execution
• T1071.001 — Web Protocols
• T1074.001 — Local Data Staging
• T1567.002 — Exfiltration to Cloud Storage
• T1528 — Steal Application Access Token
• T1610 — Deploy Container
• T1213 — Data from Information Repositories
• T1552.001 — Credentials In Files
• T1552.007 — Container API
• T1578.004 — Revert Cloud Instance
• T1005 — Data from Local System
• T1552 — Unsecured Credentials
• T1078.004 — Cloud Accounts
• T1070.004 — File Deletion
• T1552.004 — Private Keys
• T1609 — Container Administration Command
• T1525 — Implant Internal Image
• T1119 — Automated Collection