neat.no

Security Advisory – November, 2026: Brotli Decoder Vulnerability (CVE-2026-111497) Affecting Neat Devices

Advisory ID: NEAT-SA-2026-11-02
Publication date: November 02, 2026
Last updated: November 02, 2026

Status: Interim: fix in progress. The fix ships in NeatOS 26.6.3, planned for OTA Stable release on November 21, 2026. This advisory will be updated when the fix is available.

Severity: High (Neat assessment). CVSS v4.0 base score 9.2 (Google); CVSS v3.1 base score 8.1
CVSS v3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-111497

Exploitation status: CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. Neat has no evidence of exploitation against Neat devices or customers.

Summary

CVE-2026-111497 is a vulnerability in the open-source Brotli decompression library, which many products use to read compressed web content. A specially crafted compressed file could cause software that uses an affected version of the library to crash, expose memory contents, or in some conditions run unintended code. Neat devices running NeatOS use the library in components that handle web content.

Neat will fix this issue by patching the Brotli library in NeatOS 26.6.3. The release follows Neat’s standard staged firmware release process: beginning on November 7, 2026 and completing by November 21, 2026 (OTA Stable). Dates are subject to change.

This issue primarily impacts customers who use Neat Browser (Neat Open Apps) or connect devices through a captive portal. CISA has added this vulnerability to its KEV (Known Exploited Vulnerabilities) catalog. Neat has no evidence of exploitation against Neat devices or customers. Impacted customers should review the mitigations under Remediation.

Affected products

ProductAffected versionsFixed version
All Neat devices running Neat OS (Neat Bar, Neat Bar Generation 2, Neat Bar Pro, Neat Board, Neat Board 32, Neat Board 50, Neat Board Pro, Neat Frame, Neat Pad, Neat Pad Generation 2, Neat Pad Pro, Neat Center)Neat OS versions earlier than 26.6.3Neat OS 26.6.3 (2-week phased release beginning Nov 7th) 

Impact

Exploiting this vulnerability requires a device to receive specially crafted compressed content from an attacker-controlled source. The impacted paths on Neat devices are the Neat Browser (Neat Open Apps) and captive portal handling, because both process content from outside the customer’s control. Exploitation is difficult: an attacker must deliver a precisely crafted data stream, which is why the CVSS v3.1 attack complexity is rated High.

Devices using WPA2/WPA3-Enterprise with server certificate validation face a significantly lower captive portal risk. These secure protocols make it much harder for attackers to impersonate the network or serve fraudulent portal content. Open and guest Wi-Fi networks carry higher exposure.

On October 27, 2026, CISA added the vulnerability to its KEV catalog based on evidence of active exploitation, and proof-of-concept code is public. Neat has no evidence of exploitation against Neat devices or customers.

Risk assessment

Neat rates this issue High. CISA lists the vulnerability as actively exploited, and the fix reaches all customers through OTA Stable on November 21, 2026, so customers in the impacted configurations have a period of exposure until they update. Neat has not rated the issue Critical because exposure is limited to customers who use the Neat Browser (Neat Open Apps) or a captive portal, exploitation requires a precisely crafted data stream, and enterprise Wi-Fi security further reduces captive portal exposure.

Neat will reassess this rating and the release plan if it sees evidence of exploitation against Neat devices, or if reliable exploit code for these components becomes public.

Details

The vulnerability is an out-of-bounds write (CWE-787) in the Google Brotli decoder. It affects Brotli versions 1.0.3 through 1.2.0 and is fixed in Brotli versions 1.0.10, 1.1.1, and 1.2.1. Because many browsers, runtimes, and libraries bundle Brotli, vendors across the industry have published fixes.

NeatOS 26.6.3 resolves the issue by patching the Brotli library.

Remediation

Update to Neat OS 26.6.3 when available. This release follows Neat’s standard staged firmware release process: beginning on November 7, 2026 and completing by November 21, 2026 (OTA Stable). Dates are subject to change.

Devices configured for automatic updates receive the update without further action. Customers who defer or schedule updates should plan to apply it promptly. Neat will update this advisory if the dates change.

Recommended mitigations until the update is installed:

  • Install the eMudhra fix first: If your devices are not yet running Neat OS 26.5.4 (Stable channel) or Neat OS 26.6.1 (Preview channel), update them to close the certificate issue described in NEAT-SA-2026-10-21. This stops an attacker from impersonating websites to deliver malicious content, and it is an important step while NeatOS 26.6.3 is not yet available. 
  • Avoid captive portals: Connect devices over WPA2-Enterprise or WPA3-Enterprise with server certificate validation, or over wired Ethernet. If a captive portal is required, work with your network team to let Neat devices join the network without a portal page, for example by registering the devices with the network.
  • Limit Neat Browser: If you don’t need the Neat Browser (Neat Open Apps), don’t use it until the update is installed. Where you do use it, restrict it to trusted sites.
  • Limit network exposure: Use network segmentation and restrict Neat device outbound traffic to the endpoints listed in Neat’s network and firewall requirements.
  • Filter Brotli content (optional): If your web proxy or secure web gateway supports it, test blocking or rewriting responses that use Brotli compression (Content-Encoding: br) for Neat devices.

These mitigations reduce exposure but do not remove the vulnerability. Updating to Neat OS 26.6.3 is the recommended fix when available.

Acknowledgements

Not applicable. This issue was not reported directly to Neat.

References

Contact

Questions about this advisory can be directed to security@neat.no.

Revision history

DateVersionChange
November 02, 20261.0Initial publication