Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121417SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

High 7.8

In plain English

A high-severity use-after-free in surrealdb from surrealdb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 3.3.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-pm86-cc75-q463) vendor-advisory
Patch Commit patch
VulnCheck Advisory: SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends third-party-advisory