On October 26, 2026, the PHP team announced four rebuilt Windows packages containing Brotli 1.2.1 to fix CVE-2026-111497, an out-of-bounds write during Brotli decompression. The affected component is Brotli’s decoder, reached through PHP’s Windows cURL extension when automatic HTTP response decompression is enabled.
The rebuilt PHP Windows packages
PHP listed these updated packages for its 8.2 through 8.5 branches:
| PHP branch | Updated Windows package | Included Brotli version |
| 8.2 | 8.2.35-1 | 1.2.1 |
| 8.3 | 8.3.36-1 | 1.2.1 |
| 8.4 | 8.4.27-1 | 1.2.1 |
| 8.5 | 8.5.12-1 | 1.2.1 |
An out-of-bounds write happens when software writes beyond the memory area intended for that operation. PHP identifies the flaw as occurring during Brotli decompression, rather than in the PHP language runtime itself.
When the cURL path applies
PHP’s Windows cURL extension can reach the affected decoder when it automatically decompresses an HTTP response. cURL leaves that behavior disabled by default, but an application or HTTP-client library can enable it. Whether the condition applies to a particular setup therefore depends on its configuration and libraries.
How to identify the updated package
The -1 suffix marks the rebuilt Windows package with updated dependencies. PHP said the source code and runtime versions did not change, so php -v alone does not identify the rebuilt package. Check the full package version: the updated builds are 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1.
