A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Target Audience:
Individuals and organizations using software that utilizes the Brotli decoder, including those using Bun, Microsoft .NET, Python (Brotli and brotlicffi packages), and Envoy proxies.
Risk Assessment:
Critical risks of unauthorised access, memory corruption and denial of service.
Impact Assessment:
Potential for arbitrary code execution, system compromise, sensitive data disclosure, memory corruption, and denial of service.
The information provided herein is on "as is" basis, without warranty of any kind.