CVE-2026-103484

A flaw was found in pgvector. An authenticated database user can trigger an out-of-bounds write during an Inverted File Flat (IVFFlat) index build operation. This vulnerability may allow the attacker to achieve arbitrary code execution or cause a crash resulting in a denial of service on the database server.

This vulnerability is rated as an Important severity issue because an authenticated database user with permissions to build vector indexes can trigger memory corruption within the PostgreSQL server process, potentially enabling arbitrary code execution. While exploiting the memory corruption allows execution of arbitrary code with the privileges of the postgres service account, the impact is bounded to authenticated database accounts that have rights to create tables and indexes. Deployments where untrusted clients cannot create database objects or where the optional pgvector extension is not enabled are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict schema creation permissions to prevent untrusted database accounts from building indexes, or remove the optional pgvector package if vector indexing is not needed.