Actively Exploited Brotli Decoder Flaw Prompts Urgent openSUSE Security Update
openSUSE has published security announcement openSUSE-SU-2026:22213-1 for its Leap distribution, rated important, naming CVE-2026-111497 as a new indicator tied to bug report bsc#1287778. The flaw sits in the Brotli decoder and is described as an out-of-bounds write that permits remote code execution. openSUSE Leap 16.0 is the affected product, with fixed packages shipped at version 1.1.0-160000.3.1. The update covers the brotli library and its development and runtime packages on that release, and the announcement is the only vendor material describing the issue at the time of writing.
SUSE has not published exploitation details, so no attack chain should be assumed from this advisory alone. What the scoring does convey is reachability, both the CVSS v3.1 score of 8.1 and the CVSS v4.0 score of 9.2 are network accessible and require no privileges and no user interaction. The v3.1 vector marks attack complexity as high, while the v4.0 vector lowers complexity and flags an attack requirement instead, and both record high impact to confidentiality, integrity and availability. Affected packages include brotli, libbrotli-devel, libbrotlicommon1, libbrotlidec1 and libbrotlienc1, along with their x86-64-v3 variants.
Brotli decoding runs wherever compressed data is accepted, so the vulnerable code is reached by parsing attacker supplied input rather than through any privileged action on the host. Exploitation here is not theoretical, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October 2026. FIRST currently puts the probability of exploitation in the next 30 days at 82.6 percent. Unpatched openSUSE Leap 16.0 hosts therefore carry live risk today.
Attack Surface
Server OS, Endpoint OS
Tactics
Initial Access, Execution
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Apply the openSUSE Leap 16.0 patch with 'zypper in -t patch openSUSE-Leap-16.0-2009=1', or run 'zypper patch' via YaST online_update, to pull brotli, libbrotli-devel, libbrotlicommon1, libbrotlidec1, libbrotlienc1 and the x86-64-v3 variants to 1.1.0-160000.3.1.
- Verify remediation per host with 'rpm -q libbrotlidec1 libbrotlicommon1 libbrotlienc1 brotli' and treat any result below 1.1.0-160000.3.1 as still vulnerable to CVE-2026-111497.
- Patch the optimised library variants libbrotlicommon1-x86-64-v3, libbrotlidec1-x86-64-v3 and libbrotlienc1-x86-64-v3 to 1.1.0-160000.3.1 on Leap 16.0 hosts where those builds are installed, as delivered by the same openSUSE-SU-2026:22213-1 patch.
- Scope exposure by listing hosts running openSUSE Leap 16.0 and checking each for the brotli, libbrotli-devel, libbrotlicommon1, libbrotlidec1 and libbrotlienc1 packages named as affected in openSUSE-SU-2026:22213-1.
- Schedule the Leap 16.0 update ahead of routine maintenance windows, given CISA added CVE-2026-111497 to the Known Exploited Vulnerabilities catalog on 27 October 2026.
- Weight remediation planning for openSUSE-SU-2026:22213-1 using the FIRST EPSS figure of 82.6 percent probability of exploitation within 30 days for CVE-2026-111497.
- Record bug report bsc#1287778 and announcement openSUSE-SU-2026:22213-1 as the authoritative fix references for the Brotli decoder out-of-bounds write, with 1.1.0-160000.3.1 as the fixed package level to verify against.
