CVE-2026-18022: pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-08-20
Weakness: CWE-190

Description

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

Affected products

pgvector: before 0.8.6 — fixed in 0.8.6

How to fix

Upgrade to a fixed version: pgvector 0.8.6. Check the vendor advisory for mitigations.

References

https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708ae104
https://github.com/pgvector/pgvector/issues/1006

Get alerted when CVE-2026-18022 or the next vulnerability affects your stack