WinMagic
Security Advisory
CVE-2026-111497 — Brotli Decoder Out-of-Bounds Write ("Broccoli2Shell")
Reference: KB-SEC-2026-1028-02 | Published: October 28, 2026 | Status: Mixed — see product assessment
Applies to: SecureDoc Client, SES Console, SESWeb, MagicEndpoint (all versions)
Third-party component affected: Google Brotli | Severity: Critical
Executive summary
WinMagic is aware of CVE-2026-111497 (Brotli Decoder Out-of-Bounds Write ("Broccoli2Shell")), a critical vulnerability affecting the Google Brotli decompression library. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console, SESWeb, and MagicEndpoint.
SecureDoc Client, the SES Console and SESWeb are not affected. MagicEndpoint includes an affected Brotli library through a third-party component; however, the vulnerable decompression path in MagicEndpoint is not enabled, so there is no exploitable exposure in the product today. WinMagic will update the Brotli library in MagicEndpoint in an upcoming release.
Vulnerability details
CVE ID | CVE-2026-111497 |
Title | Brotli Decoder Out-of-Bounds Write ("Broccoli2Shell") |
Affected third-party component | Google Brotli decompression library |
Severity | Critical |
CVSS | Rated critical by multiple vendors; a single industry-wide CVSS score was not consistently published as of this advisory's publication date. |
Affected versions (upstream) | The upstream Brotli decoder and any product bundling it; in the Node.js ecosystem, versions prior to 22.23.4, 24.22.1, and 26.12.1. |
What the vulnerability is
The Brotli decompression library mishandles specially crafted compressed input during block processing, causing an out-of-bounds write past the end of an internal decoder buffer. The vulnerable code is in the core Brotli C decoder, which is bundled inside many downstream products that decompress Brotli-encoded data, including Node.js, Bun, Envoy Proxy, Istio, and language bindings such as Python's brotli and brotlicffi packages.
Why you should pay attention
Because many HTTP clients and frameworks decompress Brotli-encoded traffic automatically, an application can be exposed even if its own code never references Brotli directly. Exploitation requires only that the application decompress attacker-controlled Brotli data, such as an incoming request body or an external HTTP response. Depending on the host process, a successful attack can corrupt memory, crash the process, disclose sensitive information, or achieve remote code execution. Public reporting describes very wide exposure across cloud environments and internet-facing services, which is why this CVE was flagged for rapid patching industry-wide.
WinMagic product assessment
SecureDoc Client, SES Console, and SESWeb
SecureDoc Client, the SES Console and SESWeb do not include the vulnerable Brotli library. SESWeb runs on Microsoft .NET Framework, which Microsoft has confirmed is not affected. SES server components that run on modern .NET do not enable Brotli decompression.
Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-111497.
MagicEndpoint
MagicEndpoint includes an affected Brotli library through a third-party component. The vulnerable decompression path, however, is not enabled in MagicEndpoint, so the out-of-bounds write condition described in this CVE cannot be triggered in the product as currently deployed.
WinMagic will update the Brotli library in MagicEndpoint in an upcoming release, as a precautionary measure consistent with the library's upstream fix.
Conclusion: MagicEndpoint is not currently exploitable through CVE-2026-111497, because the vulnerable code path is disabled. The affected library will be updated in a future release.
Remediation
No remediation is required for SecureDoc Client, the SES Console, or SESWeb in response to CVE-2026-111497. No customer action is required for MagicEndpoint; WinMagic will update the affected Brotli library in a future MagicEndpoint release. Organizations that run Brotli-enabled services elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.
Ongoing monitoring
WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-111497. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console, SESWeb, or MagicEndpoint and update this article accordingly.
Questions about this advisory
Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-02.
WinMagic Corp.
winmagic.com