Standalone static binaries bundle the PHP brotli extension statically linked with Brotli 1.2.0. The decoder in this version contains an out-of-bounds write, which occurs when an unauthenticated remote attacker sends crafted data to applications that pass it to the `brotli uncompress add()` function. This can lead to a crash of the entire process, memory disclosure, or remote code execution.