CVE-2026-18022

HighCVSS 8.8

Published: 29/07/2026(UTC)Updated: 20/08/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Vulnerability in pgvector before version 0.8.6 allows a database user to write data out-of-bounds when building an IVFFlat index, potentially leading to arbitrary code execution. Only 32-bit systems are affected.

Risk Assessment

Organizations using pgvector on 32-bit systems are at risk of privilege escalation and potential database takeover.

Recommendation

Update pgvector to version 0.8.6 or later.

Other vulnerabilities in pgvector

CVE-2026-103484High
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Original NVD description (English source)

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS