A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1 to mitigate this issue.