{"id":"CVE-2026-18022","aliases":["DEBIAN-CVE-2026-18022","EUVD-2026-50474","GHSA-87hg-xjfg-qh5r","UBUNTU-CVE-2026-18022"],"status":"published","title":"pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00601,"percentile":0.49083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2026-07-29T18:55:54Z","modified":"2026-11-05T03:31:26Z","fixes":[{"ecosystem":"Debian:14","package":"pgvector","fixed_in":["0.8.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1","0.8.6-1","0.8.7-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6-1"}]}],"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.4-1","0.5.1-1","0.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.1-2","0.8.2-1","0.8.3-1","0.8.5-1","0.8.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-1","0.8.1-2"]}],"products":[{"vendor":"pgvector_project","product":"pgvector"}],"references":[{"url":"https://github.com/pgvector/pgvector/issues/1006","tags":["Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708ae104","tags":["Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18022","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-87hg-xjfg-qh5r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18022.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18022","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-18022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18022","title":"pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T18:55:54.658Z","modified":"2026-10-07T02:15:29.825Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-50474","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T18:55:54Z","modified":"2026-10-07T02:15:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:36.372028Z"}],"ghsa":[{"id":"GHSA-87hg-xjfg-qh5r","title":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to...","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T21:31:00Z","modified":"2026-07-29T21:31:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:09:54.918351Z"}],"nvd":[{"id":"CVE-2026-18022","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T20:17:02.593Z","modified":"2026-08-20T13:15:02.673Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-18022","title":"pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T18:55:54.658Z","modified":"2026-11-05T03:31:26.108842893Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-05T07:12:28.867005Z"},{"id":"DEBIAN-CVE-2026-18022","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T20:17:02.593Z","modified":"2026-10-02T21:00:06.769272592Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-18022","description":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","status":"published","published":"2026-07-29T20:17:00Z","modified":"2026-10-17T12:58:06.512259382Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"}]}}