Critical Buffer Overflow in Google Brotli Affects Versions 1.0.3 to 1.2.0

## Overview A critical buffer overflow vulnerability has been identified in the Brotli decoder of Google Brotli. This affects versions 1.0.3 through 1.2.0 across all platforms. The flaw allows remote unauthenticated attackers to exploit the decoder using crafted Brotli-compressed streams. ## Technical Details The vulnerability resides in the source file c/dec/decode.c. An attacker can corrupt adjacent decoder state memory, leading to various potential issues. These include disclosing sensitive memory contents, causing a denial of service, or even executing arbitrary code on the affected system. The CVSS score for this vulnerability is 9.2, indicating a high severity level. ## Impact If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive information or disrupt service availability. The potential for arbitrary code execution poses a significant risk to systems using affected Brotli versions. Organizations relying on Brotli for data compression should assess their exposure immediately. ## Mitigation Users must update any Brotli libraries or binaries from versions 1.0.3 through 1.2.0 to the latest available versions: 1.0.10, 1.1.1, or 1.2.1. This update will patch the vulnerability and mitigate the associated risks. Regularly checking for updates and applying them promptly is essential for maintaining security.