SurrealDB versions prior to 3.3.0 contain a use-after-free vulnerability in the KV backends due to leaked futures from affinitypool::spawn_local. This flaw arises when non-'static borrowed state is moved into affinity-pool closures and the returned future is leaked, allowing pool workers to access freed memory. The issue affects multiple methods including count, scan, compact, and cursor iteration. Version 3.3.0 upgrades affinitypool to 0.8.0, making spawn_local unsafe and requiring callers to ensure no leaks occur, thereby fixing the vulnerability.