Use-After-Free Vulnerability in SurrealDB's KV Backends
CVE-2026-121417

8.8HIGH

Key Information:

Vendor

Surrealdb

Status
Surrealdb
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121417?

SurrealDB versions before 3.3.0 are susceptible to a use-after-free issue within the KV backends. This vulnerability arises when borrowed transaction states are passed into affinitypool::spawn_local closures. If a Rust embedder inadvertently leaks a dispatched future (for example, via mem::forget) while the transaction is dropped, it may lead to pool workers accessing freed memory, consequently resulting in potential memory corruption or application crashes. Updating to version 3.3.0 or higher is crucial to mitigate these risks.

Affected Version(s)

surrealdb 0 < 3.3.0

surrealdb 3.3.0

References

https://github.com/surrealdb/surrealdb/security/advisorie...
vendor-advisory
https://github.com/surrealdb/surrealdb/commit/17584a18197...
patch
https://www.vulncheck.com/advisories/surrealdb-before-3.3...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

YZL0v3ZZ
.