Dear Maintainer,

The mono source package ships an embedded copy of Google Brotli in
external/corefx/src/Native/AnyOS/brotli/ (common/version.h: BROTLI_VERSION
0x1000009, i.e. Brotli 1.0.9).

This version is within the range affected by CVE-2026-111497, an
out-of-bounds write in the Brotli decoder (c/dec/decode.c), which affects
Brotli 1.0.3 through 1.2.0 according to the Debian security tracker. The
embedded copy does not contain the upstream fix: dec/decode.c still has
BROTLI_SAFE(DecodeCommandBlockSwitch(s)) and DecodeBlockTypeAndLength still
returns BROTLI_BOOL.

The system library is tracked in #1151685. The upstream fix is in these
commits:
- v1.2.1: https://github.com/google/brotli/commit/b418fa81
- v1.1.1: https://github.com/google/brotli/commit/da980636
- v1.0.10: https://github.com/google/brotli/commit/50a9b70a

mono does not Build-Depend on libbrotli-dev and debian/rules does not
mention brotli, so the embedded copy appears to be what gets built. I have
not verified that the resulting binaries link it, so please check whether
the native compression library is built from this copy. If it is,
System.IO.Compression.BrotliStream can decode untrusted input.

Suggested fix: backport the upstream fix (commit 50a9b70a applies to the
1.0.x line) or build against the system libbrotli once it is fixed.

This was found while scanning the Debian source archive for embedded copies
of vulnerable code (Google Summer of Code 2026 project with Bastien
Roucariès). Thanks for your work on mono.

Best regards,
Gajendra Nath Soren