CVE-2026-121417

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.3.0

Description A use-after-free issue exists in surrealdb-core KV backends. This occurs when borrowed transaction state is passed into affinitypool::spawn local closures that rely on future Drop for safety. In Rust embedders, leaking a dispatched future (for example, via mem::forget) and dropping the transaction can lead to pool workers reading and writing freed memory, which may result in crashes or memory corruption.

Recommendations Update SurrealDB to version 3.3.0 or later.