{"cve":"CVE-2026-115946","nvd":{"published":"2026-11-01T00:16:34.437","modified":"2026-11-01T00:16:34.437","status":"Received","description":"XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.\n\nAffected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.\n\nXS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://github.com/google/brotli/releases/tag/v1.2.1","https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes","https://www.cve.org/CVERecord?id=CVE-2026-111497"],"reference_tags":[{"url":"https://github.com/google/brotli/releases/tag/v1.2.1","tags":[]},{"url":"https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111497","tags":[]}],"products":[],"affected":[],"source":"nvd","synced_at":"2026-11-01T00:34:28.370444277+00:00"},"epss":{"cve":"CVE-2026-115946","score":0.00244,"percentile":0.15668,"date":"2026-11-01"},"kev":null,"exploits":[],"weaknesses":[],"osv":[],"fixed":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program.","Public exploits: links to the Exploit Database (https://www.exploit-db.com, by OffSec; index under GPL-2.0), Rapid7's Metasploit Framework modules (https://github.com/rapid7/metasploit-framework, BSD-3-Clause) and ProjectDiscovery's nuclei templates (https://github.com/projectdiscovery/nuclei-templates, MIT). Only the links, titles and dates are stored; no exploit code is fetched or served.","CWE names and descriptions: MITRE's Common Weakness Enumeration (https://cwe.mitre.org), Copyright © 2006–2026, The MITRE Corporation, under the CWE terms of use (https://cwe.mitre.org/about/termsofuse.html). CWE is a trademark of The MITRE Corporation."]}