Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-29T18:55:54 pgvector: pgvector: Arbitrary Code Execution via Integer Wraparound 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-787

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

A flaw was found in pgvector. An integer wraparound vulnerability exists during the IVFFlat index build process. This flaw allows a database user on a 32-bit system to write data outside of allocated memory buffers. Successful exploitation could lead to arbitrary code execution.

Only 32-bit systems are affected. Affected products support 64-bit systems only. Lightspeed Core Not affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Not affected lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Enterprise Linux 9 Not affected postgresql:16/pgvector Red Hat Enterprise Linux 9 Not affected postgresql:18/pgvector Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-trustification-service-rhel9 Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-rhel10 https://www.cve.org/CVERecord?id=CVE-2026-18022 https://nvd.nist.gov/vuln/detail/CVE-2026-18022 https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708ae104 https://github.com/pgvector/pgvector/issues/1006