Affected versions: DDM v1.9.2.26645 and earlier
Publication Date: 6 November 2026
Summary
A security vulnerability, CVE-2026-111497, has been identified in the Google Brotli decompression library. Processing specially crafted Brotli-compressed data can cause memory corruption, potentially resulting in information disclosure, denial of service or arbitrary code execution.
DDM includes affected Brotli components. Based on its assessment as of 4 November 2026, Audinate has not identified a path through which attacker-controlled data can reach the vulnerable Brotli decompression code in DDM.
Audinate recommends installing the available operating system package update described below.
Details
In DDM 1.7, 1.8 and 1.9, the affected components are present in two places:
-
Rocky Linux operating system package (
libbrotli): A security update is available. - DDM's bundled Node.js runtime: This component is separate from the operating system package and requires a DDM software release to update.
Security scanners may continue to identify the affected component in DDM's bundled Node.js runtime after the operating system update. The presence of an affected component does not, by itself, establish that the vulnerability can be exploited through DDM.
Remediation
DDM 1.8 and 1.9
Install the available operating system updates using the DDM appliance menu:
- Select Package Management, then Check for Updates.
- Install the available updates.
- Select Shutdown/Reboot, with Restart after shutdown ticked, to restart DDM.
The update includes the corrected libbrotli-1.0.9-10.el9_8.1 package. Schedule the update and restart within an appropriate maintenance window.
This procedure updates the operating system package only. It does not update the affected Brotli component in DDM's bundled Node.js runtime.
DDM 1.7 and earlier
Upgrade to the latest DDM 1.9 release, then check for and install the operating system updates described above. Upgrading DDM alone does not replace this package update step.