---
id: CVE-2026-115946
title: >-
  XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an
  out-of-bounds write in the decoder
summary: >-
  XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an
  out-of-bounds write in the decoder.


  Affected versions compile a bundled brotli into static archives that dependent
  XS modules link against at build time, rat…
severity: none
cwe:
  - CWE-1395
product: XS-libbrotli
affected:
  - XS-libbrotli < 1.2.1.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-06T13:45:08.622525Z'
published: '2026-10-31'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T13:45:18.524Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115946'
references:
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-111497'
  - url: 'https://github.com/google/brotli/releases/tag/v1.2.1'
  - url: 'https://metacpan.org/release/SYBER/XS-libbrotli-1.2.1.0/changes'
tags:
  - cve.org
epss: 0.00244
epssPercentile: 0.15694
ingestedAt: '2026-11-05T18:28:50.665Z'
---

## Overview

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.

Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1.

XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.

## Affected

- `XS-libbrotli < 1.2.1.0`

## Remediation

Upgrade to XS-libbrotli 1.2.1.0 or later and reinstall every XS module built against it.