CVE-2026-18022
pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
CVE-2026-18022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-50474
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
EUVD-2026-50474- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-87hg-xjfg-qh5r
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to...
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
GHSA-87hg-xjfg-qh5r- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
CVE-2026-18022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-787
- Updated
- 2026-11-02
OSV
pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
CVE-2026-18022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-787
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-18022
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
DEBIAN-CVE-2026-18022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-18022
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
- Record
UBUNTU-CVE-2026-18022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgvectorDebian:13 |
All versions, plus listed versions 0.8.0-10.8.1-10.8.1-20.8.2-10.8.3-1 Show 4 moreShow less0.8.4-10.8.5-10.8.6-10.8.7-1 |
None known |
pgvectorDebian:14 |
before 0.8.6-1, plus listed versions 0.8.0-10.8.1-10.8.1-20.8.2-10.8.3-10.8.4-10.8.5-1 |
0.8.6-1 |
pgvectorUbuntu:24.04:LTS |
All versions, plus listed versions 0.4.4-10.5.1-10.6.0-1 |
None known |
pgvectorUbuntu:26.10 |
All versions, plus listed versions 0.8.1-20.8.2-10.8.3-10.8.5-10.8.6-1 |
None known |
pgvectorUbuntu:26.04:LTS |
All versions, plus listed versions 0.8.0-10.8.1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-18022 is a high vulnerability (CVSS 8.8) in Pgvector Project Pgvector, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in pgvector 0.8.6-1.
References
github.com/pgvector/pgvector/issues/1006
nvd.nist.gov/vuln/detail/CVE-2026-18022
security-tracker.debian.org/tracker/CVE-2026-18022
ubuntu.com/security/CVE-2026-18022
cve.org/CVERecord?id=CVE-2026-18022