Microsoft Visual Studio 15.9.x < 15.9.84 / 16.11.x < 16.11.61 / 17.14.x < 17.14.43 / 18.x < 18.11.2 Brotli Decoder Out-of-bounds Write (CVE-2026-111497)

Version 1.2

Nov 4, 2026, 6:52 PM

CISA reference
CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A")
CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C")
Exploit attributes ("Exploit available" set to "True". "Exploitability ease" set to "Exploits are available". "Exploited by malware" set to "True")