CVE-2026-111497: Palo Alto discloses a critical Brotli buffer overflow vulnerability
27 Oct 2026
Palo Alto has recently disclosed a critical vulnerability affecting Google’s Brotli compression library, which Palo Alto Networks uses in certain components of its products.
Through our blog, we will explain what the critical buffer overflow vulnerability is about, the threat it poses, and what organizations can do.
About the vulnerability
|
CVEs/Severity score |
Vulnerability type |
Vendor/Component |
User interaction required? |
Exploitation status |
Affected products |
Affected versions |
|
CVE-2026-111497/ 9.2 (Critical)
|
Buffer overflow – Out-of-bounds write (CWE-787) & memory corruption
|
Palo Alto Networks / PAN-OS Brotli decoder
|
No |
No known malicious exploitation reported |
Specific PA-Series and VM-Series firewall deployments running vulnerable PAN-OS versions; Prisma Cloud Application Security Transporter Client is also affected
|
PAN-OS 12.2 (Before 12.2.4-h1)
PAN-OS 12.1 (Before 12.1.4-h13, 12.1.7-h11, or 12.1.10-h3, depending on the branch) |
Brotli is a data compression technology that reduces the size of data so applications and websites can transfer it more efficiently over a network. PAN-OS is an operating system for Palo Alto Networks firewalls. For the firewall to inspect the traffic in the affected configuration, it needs to decompress data, so it uses Brotli. The affected component is the Brotli decoder, and the flaw arises when the decoder processes a specially crafted malformed stream.
How can an attacker use this vulnerability?
Palo Alto Networks has reported no known malicious exploitation of the flaw.
With network access to an affected firewall deployment and the required configuration enabled, an attacker could potentially:
- Disclose sensitive data from memory.
- Crash the affected process, causing a denial-of-service condition.
- Execute arbitrary code on the affected system.
