Summary

A vulnerability in Google’s open-source Brotli compression library (CVE-2026-111497) was disclosed publicly on October 21, 2026. An application is exposed only if it decompresses Brotli data that an attacker can control, by calling System.IO.Compression.BrotliStream or BrotliDecoder, or by using System.Net.Http.HttpClient with Brotli decompression enabled. Unity’s own networking and asset loading APIs, including UnityWebRequest and AssetBundles, do not use the Brotli decoder. Where an application is exposed, a crafted Brotli stream can crash it or potentially run code at the application’s privilege level.

The Unity Package Manager client, which ships with the Unity Editor, also includes the affected library and could be impacted if users download packages from a malicious or compromised package registry. Developers should update to a patched Editor version.

There is no evidence that this vulnerability has been exploited in Unity applications, and no impact on users or customers has been identified. Unity is shipping the upstream fix in upcoming Editor releases.

Vulnerability Details

CVE ID: CVE-2026-111497

Component: Brotli decoder in the .NET class libraries shipped with the Unity Runtime (Mono libmono-native, IL2CPP, CoreCLR)

Upstream affected version: Brotli 1.0.3 through 1.2.0

Upstream fixed versions: Brotli 1.0.10, 1.1.1, 1.2.1

Date publicly disclosed: October 21, 2026

Date Brotli patch available: October 21, 2026

Affected versions: See Unity Editor version table

Vulnerability type: Buffer overflow in the Brotli decoder CWE-787

CVSS score: 9.2

CVSS vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Exploitation Potential

An attacker who can get a Unity application to decompress a crafted Brotli stream could crash it or potentially run code with the application’s privilege.

Exposed: the application passes data it receives from an untrusted source (network responses, player uploads, user generated content, third-party servers) to BrotliStream or BrotliDecoder, or uses HttpClient with Brotli automatic decompression enabled. This includes use inside third-party libraries and plugins in your project.

Not exposed: applications that never decompress Brotli data, or only decompress Brotli data they created and control. UnityWebRequest does not use Brotli. AssetBundles and other Unity archive formats support LZ4, LZ4HC, and LZMA only. Unity’s font loading does not use Brotli.

Unity Editor: the Editor does not use the Brotli decoder in any exploitable way, with one exception. The Unity Package Manager client decompresses registry responses before it verifies package signatures, so a malicious or impersonated scoped registry can trigger the vulnerability. On Windows and Mac, binary protections limit the impact to a crash. On Linux, code execution may be possible.

There is no evidence that this vulnerability has been exploited in Unity Applications.

Affected Platforms

The Brotli decoder is part of the .NET class libraries that ship with every Unity Player, on all platforms and scripting backends (Mono, IL2CPP, CoreCLR). Whether an application is affected depends on whether it decompresses untrusted Brotli data through the APIs above, not on the platform it runs on.

Unity Editor Version Table

Applications built with the listed version of the Unity Editor before the patched version are considered vulnerable if they meet the conditions above.

Patched releases are in progress for Unity 6000.0 and later. This table will be updated as each patched version is released.Last updated: October 28, 2026.

Other Unity Products

Discovery

This vulnerability is in Google’s open-source Brotli library and was disclosed publicly. It was not reported to Unity directly. Unity’s Security team identified the affected copies of Brotli in the Unity Runtime class libraries as part of its response.

Remediation Steps

Rebuild The Application

Update the Unity Editor to the patched version for your release line (see the Unity Editor version table), then rebuild and redeploy the application. The decoder ships inside the built application, so updating the Editor without rebuilding does not fix applications already shipped.

If You Cannot Update Yet

Check your project, including third-party libraries and plugins, for use of BrotliStream, BrotliDecoder, or HttpClient with Brotli automatic decompression. If none is present, your application is not exposed. If it is, remove the usage or stop passing untrusted data to it until you can rebuild with a patched Editor version.

For the Package Manager, avoid adding scoped registries you do not control until you have updated. Note that the eMudhra certificate issue (see the separate advisory) means a trust registry could be impersonated, so updating the Editor is the only complete fix.

Unity Fixed Versions

Direct links to the first fixed versions of the Unity Editor (which include the Unity Runtime).
Links will be added here as each patched version is released.Last updated: October 28, 2026.