The vulnerability lies in the sorting mechanism of SurrealDB when an ORDER BY rand() clause is used. It is caused by the weakness CWE-248, a use of uninitialized variable, that allows an authorized client to craft a query that triggers a panic in the sorting function, causing the server process to crash. This results in a denial of service that affects the availability of the database.

This issue affects all versions of SurrealDB prior to 2.1.0. The vendor is SurrealDB, and any deployment using an earlier release is susceptible. Users with authorized access are required to issue the problematic ORDER BY rand() query.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess authenticated access to issue the query, so the attack vector is internal or compromised client. Once triggered, the server process crashes, leading to a loss of availability until restarted. The exploit is straightforward: sending an ORDER BY rand() query; no complex preconditions are described.