External risk intelligence

XS::libbrotli Out-of-Bounds Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115946

This is a build-time dependency issue where a vulnerable library is statically compiled into Perl XS modules. It is not an internet-facing service, appliance, or gateway. The vulnerability only exists if a developer includes this specific module in their application, making its exposure dependent on the internal implementation of individual software projects rather than a common public-facing deployment pattern.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a Perl library that bundles an outdated component with a flaw allowing for out-of-bounds writes. This could lead to memory disclosure, process crashes, or potential code execution if untrusted data is decompressed using the affected library. Remediation requires updating the bundled component within the Perl library itself, as system-level updates are insufficient.

A library flaw could expose sensitive information.
It matters if untrusted data is processed.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker can target a vulnerable Perl module, XS::libbrotli, which bundles an outdated Brotli library. This bundled library contains a flaw that can be triggered when any dependent module decompresses untrusted data. If an attacker can supply a specially crafted Brotli stream, they could potentially corrupt the decompression process, leading to memory disclosure, crashes, or even arbitrary code execution.

Requires a dependent module to decompress data.
Triggered by a crafted brotli data stream.
Potential for memory disclosure or code execution.

Live Threat

Current exploitation, exposure, and threat context

When a dependent Perl module decompresses untrusted data using a vulnerable bundled brotli library, it could lead to memory disclosure, process crashes, or potential arbitrary code execution. This affects systems that use these specific Perl modules to process external brotli-compressed data.

Memory or code execution at risk.
Malicious brotli stream input.
Service compromise or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within Perl XS modules that bundle a specific version of the brotli library. Ownership likely falls to the teams responsible for developing or maintaining these Perl modules, or application teams that incorporate them. The initial step is to identify all internal applications and services that utilize XS::libbrotli, confirm their exposure and criticality, and then coordinate with the module owners or development teams to plan remediation.

Identify which teams own affected modules.
Verify internal usage of the XS::libbrotli module.
Plan remediation with module maintainers.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XS::libbrotli and why is it used?

XS::libbrotli is a Perl module that provides an interface to the Brotli compression algorithm. Developers use it to integrate efficient data compression and decompression directly into Perl applications. It is unique because it bundles a specific version of the Brotli library into static archives during the build process, rather than relying on the version installed on the host operating system.

What does the out-of-bounds write vulnerability mean in CVE-2026-115946?

This is a memory safety weakness where the program writes data outside of the intended memory buffer. Because the bundled library fails to validate data correctly, a specifically crafted Brotli stream can force the decoder to overwrite adjacent memory. This can lead to unauthorized memory disclosure, application crashes, or potentially allow an attacker to execute their own code.

How is this vulnerability triggered by an attacker?

The vulnerability is triggered only when a dependent Perl module processes untrusted, maliciously crafted Brotli-compressed data. Simply having the module installed is not enough; the bug does not trigger if the software only handles trusted internal data or does not decompress external streams. The process must actively invoke the vulnerable decoder on the malicious payload.

Is this vulnerability likely to be internet-facing?

According to Halo Surface Signal, this is highly unlikely. Because the vulnerability exists within a build-time dependency bundled inside specific software projects, it is not a standalone network service or gateway. Its relevance depends entirely on whether an internal application is explicitly designed to decompress external, untrusted traffic using the affected library.

What should I do if I am running software with XS::libbrotli?

First, perform an inventory to identify which internal applications use this module. Because this library uses statically linked components, updating your system's Brotli library will not fix the issue. You must coordinate with your development teams to update the Perl module to version 1.2.1.0 or newer, which contains the patched, bundled version of the Brotli library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.