CVE-2026-103484

HighCVSS 8.8

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Risk Assessment

A database user can exploit this vulnerability to execute code in the context of the database process, potentially leading to full compromise of the database server or data integrity violation.

Recommendation

Upgrade pgvector to version 0.8.7 or later. Additionally, restrict database user privileges and monitor unusual index operations.

Other vulnerabilities in pgvector

CVE-2026-18022High
Vulnerability in pgvector before version 0.8.6 allows a database user to write data out-of-bounds when building an IVFFlat index, potentially leading to arbitrary code execution. Only 32-bit systems are affected.

Original NVD description (English source)

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS