On 2026-10-27 CISA added CVE-2026-111497, a Google Brotli unchecked return value vulnerability, to its Known Exploited Vulnerabilities catalog. The flaw lets a remote unauthenticated attacker craft a Brotli-compressed stream that can corrupt adjacent decoder state memory, disclose sensitive memory contents, cause denial of service, or potentially execute arbitrary code. Required action is to apply mitigations following vendor instructions and comply with CISA’s BOD 26-04 Prioritizing Security Updates Bas. 1