APDFL risk from CVE-2026-111497
Estimated Reading Time: 10 MinutesSummary
CVE-2026-111497 is a critical out-of-bounds write in the **Google Brotli decoder**. It is
rated CVSS v4.0 **9.2 Critical**, and on 27 October 2026 CISA added it to the Known
Exploited Vulnerabilities catalogue.
APDFL statically links Brotli. Current releases of both the v18 and v21 lines carry Brotli
**1.2.0**, which falls inside the affected range.
| Product | Brotli present | Reachable in normal use | Status |
| APDFL 21 | | | | (through 21.0.0PlusP1f, the current release) | 1.2.0 | **Yes** — decode and encode | Affected |
| APDFL 18 | (through 18.0.5PlusP2e) | 1.2.0 | **Yes** — decode | Affected |
| PDF Converter 3.2 | 1.2.0, via embedded APDFL | **No** — see below | Present but inert |
**The remediation is to upgrade to the next release after APDFL 18.0.5PlusP2e or 21.0.0PlusP1f.** Updating to Brotli 1.2.1 is complete in development and is scheduled for the next release of each product line.
Note the wording carefully: it is the release *after* those, not those releases themselves.
Both were built before Brotli 1.2.1 was published upstream and both still carry 1.2.0 — including 21.0.0PlusP1f, which was released on 30 October 2026 and is the current v21 release. On both lines, upgrading to the newest release available today does not clear this
finding. See *Which release contains the fix* below.
If you only need to answer a scanner, skip to *Confirming the version in your own kit*.
The vulnerability
From the upstream advisory (GHSA-9v8h-qqgm-4m35):
> A buffer overflow vulnerability in the Brotli decoder (`c/dec/decode.c`) in Google Brotli
> versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to
> corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial
> of service, or potentially execute arbitrary code using a crafted Brotli-compressed
> stream.
- **Affected:** Google Brotli 1.0.3 through 1.2.0, all platforms
- **Fixed in:** 1.0.10, 1.1.1, or 1.2.1
- **CWE:** CWE-252 (Unchecked Return Value), leading to CWE-787 (Out-of-bounds Write)
- **CVSS v4.0:** 9.2 Critical — `AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
- **CISA KEV:** added 27 October 2026; BOD 26-04 remediation due date 10 November 2026
- **Published:** 22 October 2026
Two properties of this CVE deserve emphasis, because they determine how it should be
assessed against a PDF library.
**It is a decoder bug.** The defect is in decompression, not compression. Whether your
application ever *produces* Brotli-compressed output is irrelevant to your exposure. What
matters is whether it ever *decompresses* Brotli data that someone else supplied.
**It is reached through data, not configuration.** The attacker controls the compressed
stream. There is no setting on the victim's side that has to be enabled first.
Where Brotli is used in APDFL
Brotli is a stream compression filter. The PDF Association published it as an extension to
PDF 2.0 (it is not part of ISO 32000-2:2020), and streams compressed with it carry the
filter name `/BrotliDecode`.
APDFL implements both directions, as `BrotliDecodeFilter` and `BrotliEncodeFilter`. They
behave quite differently from a security standpoint:
Decoding — not opt-in
When APDFL processes a stream whose `/Filter` is `/BrotliDecode`, it decodes it. This is
ordinary filter handling: it is not gated behind an API flag, and there is no option to
decline it. Any operation that reaches the stream's data — rendering, text extraction,
image extraction, optimisation, or re-saving — will run the decoder.
**This is the path that matters for CVE-2026-111497**, and it is present in both product
lines, including APDFL 18 builds that expose no Brotli API of their own. A v18 application
that opens a PDF containing a `/BrotliDecode` stream will decode it, which is why Brotli
strings are visible in `DL180pdfl.dll` and `libDL180pdfl.so`.
Encoding — opt-in, and v21 only
APDFL 21 added `PDSaveAddBrotli` (a `PDDocSaveFlags` value) to compress streams with Brotli
on save. It is off unless your code sets it. APDFL 18 has no public API for Brotli
compression.
The encoder is not where this vulnerability lives, so the presence or absence of
`PDSaveAddBrotli` in your code does not change your exposure.
PDF Converter 3.2
PDF Converter embeds APDFL as a component, so Brotli appears in its SBOM:
adobe_pdf_converter 3.2.0+p1s
└── adobe_pdf_library 21.0.0+p1e
└── brotli 1.2.0
A scanner examining a Converter installation will therefore report this CVE, and that
report is accurate as a statement about what is on disk.
However, **Converter's use of APDFL neither reads nor generates Brotli-encoded streams**.
Converter's job is to convert PostScript, EPS, and image input into PDF; the APDFL code it
drives does not take Brotli-compressed input and does not emit Brotli-compressed output. The
Brotli library is linked in but is not reachable through any Converter workflow. It is inert.
Converter will pick up Brotli 1.2.1 in its next release along with its other component
updates, which will clear the finding. In the meantime the correct characterisation for a
security team is **present in the SBOM, not reachable in execution** — a vulnerable
component that no code path invokes is not an exploitable vulnerability.
Confirming the version in your own kit
You do not need to ask us which Brotli version your build contains. Every APDFL release ships a CycloneDX SBOM:
```
<install>\Documentation\sboms\adobe_pdf_library_sbom.cdx.json
```
PDF Converter ships one at the root of the installation:
```
<install>\adobe_pdf_converter_sbom.cdx.json
```
Search it for the `brotli` component. The entry looks like this:
```json
{
"bom-ref": "pkg:conan/brotli@1.2.0?rrev=f91c979e3918d555c954b40ab88d917d",
"name": "brotli",
"version": "1.2.0",
"purl": "pkg:conan/brotli@1.2.0",
"licenses": [ { "license": { "id": "MIT" } } ],
"type": "library"
}
```
The SBOM is authoritative for that build. It is also the right artifact to hand your
security team, since it is machine-readable evidence rather than a vendor assurance.
Note that Brotli is pinned to a single source package shared across both product lines, so
the version is consistent across releases rather than varying build to build. A scanner
reporting several different Brotli versions across different APDFL binaries is inferring
them rather than reading them; see
[Interpreting CVE Findings Reported Against APDFL Binaries](apdfl-interpreting-cve-scan-findings.md).
Assessing your own exposure
The question that determines your risk is narrow:
> Does my application decompress PDF streams from sources I do not control?
If your application only processes PDFs your own systems generate, the decoder is never
handed attacker-controlled input and your practical exposure is low. If it accepts uploads,
processes email attachments, or handles documents from customers or partners, the decoder is
reachable by an attacker and should be treated as exposed.
**A caution on reasoning from rarity.** Brotli compression in PDF is new, is a PDF
Association extension rather than part of ISO 32000-2:2020, and is rare in documents
encountered in the wild today — it is considerably more common in web fonts. That is a true
observation about benign documents and a poor basis for a risk assessment. The attacker
chooses the file. How rarely Brotli appears in ordinary PDFs tells you nothing about how
easily someone can construct one that is not ordinary, and the KEV listing indicates that
exploitation of this defect is being attempted in practice.
Which release contains the fix
The Brotli 1.2.1 update is complete in development and is scheduled per product line:
|
Product line
|
Upgrade to |
| APDFL 18 | The next release **after** 18.0.5PlusP2e |
| APDFL 21 | The next release **after** 21.0.0PlusP1f |
| PDF Converter 3.2 | The next release |
This is an exception to the usual guidance. Upgrading to the newest available release
normally resolves a component finding, and for most findings it is the right first move.
Here, the newest release on each line predates the upstream fix — 21.0.0PlusP1f was
released on 30 October 2026 and still carries Brotli 1.2.0 — so upgrading to it leaves the
finding in place.
**Why the current release does not already carry the fix.** Component versions are frozen
when a release is built, and QA runs against that frozen set before the release is
published. The P1f build was made on 20 October 2026, as its own SBOM records.
CVE-2026-111497 was published on 22 October, and Brotli 1.2.1 reached the package index our
builds draw from on 23 October. The build therefore predates both the advisory and the
availability of the fixed component. Builds made after that date pick up 1.2.1
automatically, which is why the fix arrives in the following release rather than requiring
a separate patch.
Check the SBOM of any release before concluding that an upgrade has resolved this finding.
The SBOM is the quickest way to confirm you have landed on a build carrying Brotli 1.2.1 or
later.
For current release dates, see the APDFL release notes and service bulletins, or contact
Support. If the BOD 26-04 due date of 10 November 2026 applies to you, please raise a case
rather than waiting — tell us which product and platform you need and we will give you the
current schedule and discuss options.
Interim measures
Until a fixed release is available, the following reduce exposure. None is a substitute for
the update.
**Restrict what reaches the decoder.** The most effective control is to treat PDFs from
untrusted sources as untrusted input generally: process them in a sandboxed or
least-privilege context, so that memory corruption in the decoder does not yield a
foothold. This is good practice for any PDF processing and is not specific to Brotli.
**Find out whether you are handling such files at all.** A raw byte search for the string
`BrotliDecode` across a corpus is a cheap way to establish whether Brotli-compressed PDFs
appear in your workload. Most organizations will find none.
Treat this as triage, not as a security control. It can miss cases: a stream's `/Filter`
entry may be an indirect reference rather than a literal name, and in an encrypted document
the relevant strings may not be visible to a byte scan. Use it to size the problem, not to
clear individual files.
**Do not rely on disabling encoding.** Removing `PDSaveAddBrotli` from your save flags
stops APDFL producing Brotli-compressed output. It has no effect on the decoder, which is
where the vulnerability is.
Reporting to a security team
A defensible summary for an internal risk register:
- The component is Google Brotli, statically linked into APDFL, version **1.2.0**, confirmed
from the vendor SBOM shipped with the build.
- The version is within the affected range (1.0.3–1.2.0). The finding is **genuine**, not a
version-detection artefact.
- The exploitable path is **decompression of attacker-supplied PDF streams** using the
`/BrotliDecode` filter. It is not gated behind any application setting.
- For PDF Converter specifically, the component is linked but **not reachable** through any
Converter workflow.
- Remediation is a vendor update to Brotli 1.2.1, scheduled as above.
See Also
- [Interpreting CVE Findings Reported Against APDFL Binaries](apdfl-interpreting-cve-scan-findings.md)
- [NVD entry for CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
- [GitHub advisory GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)
- [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Brotli compression advances in PDF (PDF Association)](https://pdfa.org/no-excuses-brotli-compression-advances-pdf/)
How to Get Additional Help
For further assistance with this vulnerability or with security scanning findings against
APDFL, you can reach out for support. You can send an email to our technical support team at
[tech_support@datalogics.com](mailto:tech_support@datalogics.com).
Have questions while using APDFL? Fetch the answers quickly using our AI assistant
[Scout](https://www.datalogics.com/?askai=true), available for any language.
[Scout](https://www.datalogics.com/?askai=true) also opens access to our MCP server,
connecting APDFL with your favorite AI tools for faster and easier coding.