Surrealkv versions prior to 1.2.0 contain an out-of-bounds read vulnerability when decoding internal keys shorter than 16 bytes. The safe constructor InternalKeyRef::from_encoded performs a length check only in debug builds, which is omitted in release builds, leading to unchecked slice arithmetic and reading memory before the buffer. This can cause undefined behavior and heap-buffer-overflow. The vulnerability can be triggered by crafted or corrupted SSTables. Version 1.2.0 fixes this by rejecting internal keys shorter than their 8-byte trailer and adding bounds checks to accessors.