[C++] Bundled Brotli 1.0.9 is affected by CVE-2026-111497 (decoder out-of-bounds write) #55166

CVE-2026-111497 is an out-of-bounds write in the Brotli C decoder (c/dec/decode.c, versions 1.0.3 through 1.2.0). A crafted stream can request an impossible block switch, which the decoder mistakes for "needs more input". It then writes past the end of an internal 8-byte buffer. GitHub rates it 9.2 (CVSS 4.0), and Node.js shipped fixes for it on 2026-10-21.

cpp/thirdparty/versions.txt pins ARROW_BROTLI_BUILD_VERSION=v1.0.9, and that version is used whenever Brotli is built as a bundled dependency. In those builds, reading a Parquet or IPC file that contains Brotli-compressed data passes the file's contents to the decoder, so a crafted file can trigger the bug. Builds that link a patched system Brotli aren't affected.

Upstream fixed this in Brotli 1.0.10, 1.1.1 and 1.2.1 (fix commit). Updating the bundled copy to v1.2.1, or applying that commit, resolves it. A patched copy is easy to recognise: its decode.h defines BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17).

References:

• Advisory: GHSA-9v8h-qqgm-4m35
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• Upstream release: https://github.com/google/brotli/releases/tag/v1.2.1
• Overview of affected software and bundled copies: https://broccoli2shell.com/