Inferlume

The underlying vulnerability exists within the Brotli decompression engine located inside the source file c/dec/decode.c. During decompression of a streaming payload, the decoder maintains internal tracking of block switch processing. When an attacker crafts an illegal block switch sequence where the stream declares a single block type but commands an immediate switch, the decoder encounters an invalid state.

Due to an unchecked return value and improper state handling, the decoder misinterprets this format violation as an incomplete stream requiring more input data rather than terminating with an unrecoverable format error. As the decoder continues reading succeeding stream chunks, it appends incoming attacker bytes past an internal eight byte working buffer, generating an out of bounds write heap condition.

[+]\ Inbound Vector: An unauthenticated attacker transmits an HTTP POST or PUT request containing the header Content-Encoding: br to an internet facing application. If the web server framework, such as Express 5 or ASP.NET Core with request decompression enabled, inflates the body, heap metadata is corrupted before authorization checks occur.

[+]\ Outbound Vector: Server side applications that utilize native fetch routines or libraries like requests and httpx to query external URLs or webhook endpoints consume a malicious Brotli stream returned from an attacker controlled origin. The downstream application decodes the response, triggering heap corruption and reciprocal client exploitation.

[+]\ Detailed Heap Memory Layout Architecture: Within the C decoder library, the primary state container allocated on the heap is the BrotliDecoderState structure. This memory structure organizes sequential functional segments including the bit reader sub structure, an internal eight byte staging buffer, state machine enumerations, Huffman decoding tree pointers, and the circular decompression ring buffer pointers ringbuffer, ringbuffer_mask, and ringbuffer_end. Directly adjacent in dynamic memory reside custom memory management pointers allocate_func, free_func, and opaque context structures.

[+]\ Linear Buffer Overflow Dynamics: When the malformed block switch commands are parsed, the decoder attempts to stage incoming variable length bit chunks into the eight byte buffer. Because the parser erroneously loops while waiting for non existent valid block headers, the buffer write head advances without boundary bounds checking. The subsequent payload bytes spill directly out of the eight byte buffer into the immediately adjacent 64 bit pointers of the BrotliDecoderState structure.

[+]\ Primitive 1 Ringbuffer Pointer Redirection: The first critical corruption target is the ringbuffer pointer itself. By precisely calculating the stream offset, an attacker overwrites this pointer with an arbitrary virtual memory address inside the process space, such as an adjacent application session store, cryptographic key buffer, or thread local storage. As the Brotli engine continues processing standard literal and copy commands present later in the malicious stream, it writes decompressed content directly into the attacker specified destination, transforming an out of bounds write into an arbitrary write what where primitive.

[+]\ Primitive 2 Allocator Function Pointer Hijack: When Brotli instances are instantiated by language wrappers such as Node.js or embedded proxy engines, custom memory allocation callbacks are populated within the BrotliDecoderMemoryManager sub structure. When the heap overflow overwrites the free_func pointer, the attacker replaces the original deallocation function address with the address of system or a Return Oriented Programming gadget chain. The moment the connection closes, the stream terminates, or an unhandled exception triggers cleanup, BrotliDecoderDestroyInstance invokes the corrupted function pointer, immediately transferring instruction control to attacker controlled shellcode or system commands.

[+]\ Primitive 3 Heap Chunk Metadata Corruption: In enterprise container environments utilizing standard glibc allocators, the BrotliDecoderState heap allocation resides alongside other C++ runtime objects, V8 engine ArrayBuffer backing stores, or network socket buffers. Overwriting chunk size fields, previous in use flags, and forward or backward pointers corrupts the allocator bin structures. When adjacent allocations are recycled during normal asynchronous request handling, tcache poisoning or fastbin consolidation primitives allow the attacker to force the memory allocator into granting an overlapping chunk on top of application function dispatch tables.