edk2 vendors a copy of brotli at:
MdeModulePkg/Library/BrotliCustomDecompressLib/brotli/c/common/platform.h

This copy predates commit 4792c8e (April 2026) which fixes an integer
overflow in compound dictionary size handling. The fix introduces
brotli_safe_add_int() -- a safe overflow-checked addition helper --
which is absent in the bundled copy.

No CVE has been assigned yet. The fix is public at:
https://github.com/google/brotli/commit/4792c8e

Please update the bundled brotli to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren
gajendranath025@gmail.com