Microsoft released .NET, Visual Studio and PowerShell updates on 25 October for a buffer overflow inside Google's Brotli compression library, and Palo Alto Networks confirmed the following day that PAN-OS is affected as well. The flaw is not known to be exploited in the wild, but it sits in a library that dozens of products embed and forget about.
What happened
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder in versions 1.0.3 through 1.2.0. A crafted compressed stream can corrupt adjacent decoder state, disclose memory contents, crash the process, or potentially execute arbitrary code. Google scored it 9.2 under CVSS v4.0. It is fixed in 1.0.10, 1.1.1 and 1.2.1.
The root cause was patched in the Brotli source in February without anyone realising it was a security bug, and no release followed until now. OpenAI's Codex Security team found the issue during red-teaming and notified the affected projects. Imperva then demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, both through a response fetched from an untrusted server and through a request body parsed by Express 5 or body-parser 2, though not on every attempt.
Microsoft shipped .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 Release Candidate 3, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4, 7.5 and 7.6. The Python packages brotli 1.2.1 and brotlicffi 1.2.1.0 are also out. Palo Alto's hotfixes cover PAN-OS 12.2, 12.1 and 11.2, and its advisory notes that many build numbers overlap with the PHP2Shell hotfix list.
Who is affected
- .NET applications and services that decompress data from clients, partners or third-party APIs.
- Node.js services built before the October security releases, and PowerShell 7.4, 7.5 and 7.6.
- PAN-OS 12.2 before 12.2.4-h1, 12.1 before 12.1.4-h13, and 11.2 before 11.2.4-h23.
- Anything bundling its own copy of the decoder. A public tracker still listed DuckDB, Apache Arrow, 7-Zip-zstd and p7zip as unpatched in the days after disclosure.
What to do now
Patch the runtime, then rebuild and redeploy every container image built on it, because a running process keeps using the vulnerable copy until it is restarted.
- Update .NET to 8.0.33, 9.0.22 or 10.0.14, PowerShell to the current 7.4, 7.5 or 7.6 release, and Node.js to its October security build.
- Rebuild container images from patched base images rather than patching inside running containers, then restart the services.
- On PAN-OS, apply the hotfix for your branch and record the resulting version in your firewall inventory.
- Inventory self-contained applications that ship their own Brotli copy and check each against its vendor's advisory.
What this means for South African businesses
This is a library bug rather than a product bug, which makes it easy to dismiss and hard to actually close out, because the vulnerable code can appear in three different layers of the same stack. The attack path also needs the attacker's compressed data to reach the decoder, so a back-office report generator is a different proposition from an internet-facing API or a file upload feature. My judgment is that an SME's realistic exposure is the public endpoint that accepts compressed input, and the container image nobody has rebuilt since it was deployed.
Source: SecurityWeek - Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.