The vulnerability is triggered when an authorized client sends a pre‑parsed query that calls a nonexistent built‑in function. The query executor does not catch the resulting exception, causing a panic that crashes the SurrealDB server. This flaw is categorized as CWE‑248, unexpected exception causes a crash, and results in a denial of service for all users connected to the database.

SurrealDB versions earlier than 1.2.0 are affected. The flaw applies to any deployment of SurrealDB prior to release 1.2.0, regardless of operating environment or configuration.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at the moment. The issue is not listed in CISA’s KEV catalog. Because only authorized clients can trigger the exploit, an attacker would need authenticated or privileged access to submit crafted queries. Once triggered, the server process crashes, causing a denial of service for all clients.