IO::Compress::Brotli CVE-2026-115936

Exploitation requires that an application actually decompress attacker-controlled (untrusted) brotli data through this module's unbro function or decompress method while running a bundled-vulnerable release (0.004001 through 0.022, which statically compile brotli 1.0.4-1.2.0). The key limiting factor is this data-flow precondition: deployments that only compress, or only decompress trusted/self-generated streams, are not reachable. A critical non-obvious constraint is that upgrading the system/OS brotli library does NOT remediate this, because the vulnerable decoder is statically bundled into the module - only upgrading IO-Compress-Brotli to 0.023 (brotli 1.2.1) fixes it. The advisory does not describe required user interaction or authentication, and no CVSS vector is provided, so authentication requirements are not confirmed from available data.

No quantitative exploitation signals are available: CVSS is N/A in the input, there is no EPSS score, the CVE is not in CISA KEV, and no public exploit was identified at time of analysis. The vuln.today decision label is 'awaiting_data', so no priority framework (SSVC/automatable/technical-impact) has been scored yet. The underlying defect is well-characterized, however: IO::Compress::Brotli 0.004001 through 0.022 statically bundle brotli 1.0.4-1.2.0, all of which carry the decoder out-of-bounds write tracked as CVE-2026-111497; 0.023 bumps the bundled copy to brotli 1.2.1. The realistic risk is therefore scoped to applications that decompress untrusted brotli data through this module - for those, an out-of-bounds write offering memory disclosure, process crash, or potential code execution is a genuine concern, not merely a high-CVSS-but-low-impact issue. For deployments that never decompress attacker-controlled input, exposure is minimal. Because no CVSS vector is supplied, authentication requirements cannot be confirmed from the data; the attacker-controlled surface is the decompressed input, not an authenticated session. The commit reference is a fix (submodule bump), not exploit code.

An application uses IO::Compress::Brotli (0.004001-0.022) to decompress brotli data that originates from an untrusted source - for example an HTTP response body, an uploaded file, or a message payload - via unbro or the decompress method. An attacker supplies a crafted brotli stream that drives the bundled vulnerable decoder into an out-of-bounds write, corrupting decoder state to leak memory, crash the process, or potentially achieve code execution. No public exploit was identified at time of analysis.