[ CVE-2026-103484 · Published 1 Oct 2026 ]

Vulnerability in pgvector

CVSS 8.8 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund19 Oct 2026WID-SEC-2026-4029

Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Multiple vulnerabilities Translated from German
Risk highCVE-2026-89059CVE-2026-82397CVE-2026-87766+3 more CVEs

[ References ]References

github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156
github.com/pgvector/pgvector/issues/1036

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Multiple vulnerabilities Translated from German

[ References ]References