Problem

Are Validation Authority, Destkop Validator or Server Validator vulnerable to CVE-2026-111497, the buffer overflow in the Google Brotli decoder?

Resolution

We performed an assessment of VA, DV and SV and its bundled components with respect to CVE-2026-111497, a vulnerability affecting the Google Brotli decoder in Brotli versions 1.0.3 through 1.2.0. Our analysis found the operating system contains Brotli runtime libraries version 1.1.0, which falls within the affected version range identified by the vulnerability advisory. VA, DV & SV were examined and no shared libraries were found to dynamically link against the Brotli libraries. The core functionality, for VA, DV & SV does not rely on Brotli-compressed data.

No evidence was found that Validation Authority processes attacker-controlled Brotli-compressed content through a vulnerable code path. Based on our current investigation, VA, DV & SV are not known to be vulnerable to CVE-2026-111497, as the product does not appear to use the affected Brotli decoder functionality required to exploit the vulnerability. The presence of Brotli libraries on the underlying operating system alone does not indicate product exposure.

At this time, we have not identified a vulnerable or exploitable path within Validation Authority related to CVE-2026-111497. As a general security best practice, customers should continue to apply operating system updates that address vulnerable Brotli packages and maintain supported platform patch levels. Fixed Brotli versions are 1.0.10, 1.1.1, and 1.2.1, depending on the release branch.