Detections
Analytics

PHP <= 8.2.35 / 8.3.x <= 8.3.36 / 8.4.x <= 8.4.27 / 8.5.x <= 8.5.12 Windows Build Brotli Buffer Overflow

critical Nessus Plugin ID 374262

Synopsis

The PHP Windows build installed on the remote host is potentially affected by a buffer overflow vulnerability.

Description

The version of PHP installed on the remote Windows host is at or prior to 8.2.35, 8.3.x at or prior to 8.3.36, 8.4.x at or prior to 8.4.27, or 8.5.x at or prior to 8.5.12. It is, therefore, potentially affected by a buffer overflow vulnerability in the Brotli library bundled with the PHP Windows packages, as referenced in the 26 October 2026 PHP security advisory.

 - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. In PHP, the affected Brotli code is reachable through the cURL extension when automatic HTTP response decompression is enabled, which is disabled by default in cURL.
 (CVE-2026-111497)

Note that the updated Windows packages (8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1) are package rebuilds against the updated Brotli dependency. They use the same PHP source releases and the PHP runtime version remains unchanged, so Nessus cannot determine whether the updated package is installed. Nessus also cannot determine whether automatic HTTP response decompression is enabled in the cURL extension.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Install the updated PHP Windows build 8.2.35-1, 8.3.36-1, 8.4.27-1, or 8.5.12-1 (or later), which bundles Brotli 1.2.1.

See Also

https://github.com/google/brotli/releases/tag/v1.2.1

https://www.php.net/archive/2026.php#2026-10-26-1

Plugin Details

Severity: Critical

ID: 374262

File Name: php_win_2026_10_26_brotli.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 10/30/2026

Updated: 10/30/2026

Configuration: Enable paranoid mode, Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

Percentile: 99.83

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-111497

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: Settings/ParanoidReport, installed_sw/PHP

Patch Publication Date: 10/26/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-111497

CWE: 252, 787

IAVA: 2026-A-1204