VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)
39445
28 October 2026
28 October 2026
OPEN
CRITICAL
7.5-9.8
CVE-2026-111497
| Advisory ID: | VMSA-2026-0008 |
| Advisory Severity: | Critical |
| CVSSv3 Range: | 7.5-9.8 |
| Synopsis: |
Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497) |
| Issue date: | 2026-10-27 |
| Updated on: | 2026-10-27 (Initial Advisory) |
| CVE(s) |
CVE-2026-111497 |
1. Impacted Products
- VMware Cloud Foundation
2. Introduction
Node.js Brotli decoder out-of-bounds write remote code execution vulnerability. Workarounds are available to remediate this vulnerability in affected Broadcom products.
3. SDDC Manager remote code execution vulnerability (CVE-2026-111497)
Description:
Node.js as used in SDDC manager contains a remote code-execution vulnerability due to an out-of-bounds write issue in Brotli decoder. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Note that this critical score applies only to SDDC Manager 9.1.1.x; older releases are not critically impacted by this vulnerability.
Known Attack Vectors:
A malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code.
Resolution:
To remediate CVE-2026-111497 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds:
See the Response Matrix.
Additional Documentation:
None
Acknowledgments:
None.
Notes:
None.
Response Matrix:
|
VMware Product |
Component |
Version |
Running On |
CVE |
CVSSv3 |
Severity |
Fixed Version |
Workarounds |
Additional Documentation |
|---|---|---|---|---|---|---|---|---|---|
|
VMware Cloud Foundation, VMware vSphere Foundation |
SDDC Manager | 9.1.1 | Any | CVE-2026-111497 | 9.8 | Critical |
Patch pending |
KB460732 | None |
|
VMware Cloud Foundation, VMware vSphere Foundation |
SDDC Manager | 9.0.x, 9.1.0 | Any | CVE-2026-111497 | 7.5 | Important |
Patch pending |
KB460734 | None |
| VMware Cloud Foundation | SDDC Manager | 5.2.x | Any |
CVE-2026-111497 |
7.5 | Important | Patch pending | KB460734 | None |
4. References
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497
FIRST CVSSv3 Calculator:
CVE-2026-111497:
SDDC Manager 9.1.1.x - https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A
SDDC Manager 9.1.0.x, 9.0.x, 5.2.x - https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5. Change Log:
2026-10-27 VMSA-2026-0008
Initial security advisory.
6. Contact:
E-mail: [email protected]
PGP key
https://knowledge.broadcom.com/external/article/321551
VMware Security Advisories
https://www.broadcom.com/support/vmware-security-advisories
VMware External Vulnerability Response and Remediation Policy
https://www.broadcom.com/support/vmware-services/security-response
VMware Lifecycle Support Phases
https://support.broadcom.com/group/ecx/productlifecycle
VMware Security Blog
https://blogs.vmware.com/security
X
https://x.com/VMwareSRC
Copyright 2026 Broadcom. All rights reserved.