HIGH 7.7 NVD
CVE-2026-116489
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.
References
- https://github.com/timescale/pgvectorscale
- https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/buil
- https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.
- https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_v
- https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-10-26 via NVD.
vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.