CVE-2026-103484CWE-1284CWE-787

CVE-2026-103484

High · published October 2, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00422 · 35.5th percentile
Weaknesses
CWE-1284 · Improper Validation of Specified Quantity in Input; CWE-787 · Out-of-bounds Write
Published
2026-10-02T00:17Z
References (2)
https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156 · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007https://github.com/pgvector/pgvector/issues/1036 · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:49Z
    pgvector buffer overflow in IVFFlat index build
    cvelistv5