Junglewise Threat Intelligence

CVE-2026-18022: PostgreSQL pgvector integer wraparound in IVFFlat index build

CVE-2026-18022 · Severity: high · CVSS 8.8 · Published 2026-07-29

Vendors: PostgreSQL.

Executive brief

pgvector is an open-source extension for PostgreSQL that allows for efficient searching of vector data, commonly used in AI and machine learning applications. A security flaw in how the software builds specific search indexes on 32-bit systems could allow a database user to crash the service or potentially take full control of the database server. This could lead to unauthorized access to sensitive data or a complete disruption of operations for organizations running PostgreSQL on older 32-bit hardware or operating systems.

Technical details

An integer overflow/wraparound vulnerability exists in the IVFFlat index build component of pgvector (specifically within `src/ivfkmeans.c`) when running on 32-bit architectures. The flaw occurs during memory allocation size calculations for index centers, where a large number of centers or samples can cause a wraparound, leading to an undersized buffer allocation. An authenticated database user with permissions to create an IVFFlat index can exploit this to perform an out-of-bounds write. This memory corruption can result in a denial of service or arbitrary code execution in the context of the PostgreSQL process. The issue is fixed in version 0.8.6.

Affected products

  • PostgreSQL pgvector before 0.8.6

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: patched: Fixed in version 0.8.6
  • 2026-07-29: advisory

References