What’s Vulnerable › Vulnerabilities

CVE-2026-103484: pgvector buffer overflow in IVFFlat index build

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-02
• Weakness: CWE-787

Description

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Affected products

• pgvector: before 0.8.7 — fixed in 0.8.7

How to fix

Upgrade to a fixed version: pgvector 0.8.7. Check the vendor advisory for mitigations.

References

• https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156
• https://github.com/pgvector/pgvector/issues/1036

Get alerted when CVE-2026-103484 or the next vulnerability affects your stack