A buffer overflow in the Brotli decoder (c/dec/decode.c) affects Google Brotli 1.0.3 through 1.2.0 on every platform and lets a remote, unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents and cause a denial of service. CISA added it to the Known Exploited Vulnerabilities catalogue on 27 October. The decoder is embedded in a very large number of web servers, proxies and content pipelines, so the exposed surface runs well past organisations that call Brotli directly, and the flaw sits on the request path where an exploit needs no credentials.