Dear Maintainer,

The edk2 source package embeds Google Brotli as a submodule at
MdeModulePkg/Library/BrotliCustomDecompressLib/brotli (listed in
EMBEDDED_SUBMODULES in debian/rules). c/common/version.h in that copy
reports Brotli 1.2.0.

Brotli 1.2.0 is the last release affected by CVE-2026-111497, an
out-of-bounds write in the Brotli decoder (c/dec/decode.c), which affects
1.0.3 through 1.2.0 according to the Debian security tracker. The embedded
decode.c does not contain the upstream fix (no BROTLI_SAFE_WITH_STATUS).

The system library is tracked in #1151685. The fix is in Brotli v1.2.1:
https://github.com/google/brotli/commit/b418fa81

I am not claiming a practical exploit path here. This library decompresses
Brotli-compressed firmware volumes, so exposure is limited to
attacker-controlled firmware or volume contents. It is still worth updating
the submodule, or applying the upstream patch, so the embedded copy matches
the fixed upstream.

This was found while scanning the Debian source archive for embedded copies
of vulnerable code (Google Summer of Code 2026 project with Bastien
Roucariès).

Best regards,
Gajendra Nath Soren