A buffer overflow exists in the Brotli decoder within Google Brotli versions 1.0.3 through 1.2.0 on all platforms. The vulnerability permits a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially disclose sensitive memory contents, cause denial of service, or execute arbitrary code by sending a crafted Brotli‑compressed stream. This flaw is classified as an out‑of‑bounds write (CWE-787).

Any software that incorporates the vulnerable Brotli libraries or binaries is affected. The CNA vendor/product list only specifies Google Brotli, so it is inferred that any application embedding Brotli 1.0.3‑1.2.0 on any platform may be impacted; this inference is not explicitly stated in the CNA list.

The CVSS score of 9.2 indicates a high‑severity risk. Given the EPSS score of 83%, the potential for arbitrary code execution and lack of authentication requirement mark a high risk of exploitation. The vulnerability is listed in the CISA KEV catalog, indicating documented exploitation activity. Successful exploitation would allow an attacker to compromise the host environment used for decoding Brotli assets.