Package: edk2 Version: 2026.05-2 Severity: minor Tags: security X-Debbugs-Cc: [email protected]
edk2 vendors a copy of brotli at: MdeModulePkg/Library/BrotliCustomDecompressLib/brotli/c/common/platform.h This copy predates commit 4792c8e (April 2026) which fixes an integer overflow in compound dictionary size handling. The fix introduces brotli_safe_add_int() -- a safe overflow-checked addition helper -- which is absent in the bundled copy. No CVE has been assigned yet. The fix is public at: https://github.com/google/brotli/commit/4792c8e Please update the bundled brotli to the latest upstream version. Found by: Attack of the Clones GSoC 2026 pipeline (salsa.debian.org/rouca/gsoc2026) Gajendra Nath Soren [email protected]
