Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-29 | 1 | Disclosure1 |
| 2026-07-30 | 1 | Patch1 |
CVE-2026-18022 Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. O… https://www.cve.org/CVERecord?id=CVE-2026-18022
Post summary
The post discloses CVE-2026-18022, noting an int wraparound in pgvector’s IVFFlat build that could lead to arbitrary code execution before version 0.8.6.
🚨High - pgvector IVFFlat Index Build Integer Wraparound OOB Write (CVE-2026-18022) pgvector's IVFFlat index build on 32-bit systems hits an integer wraparound when computing buffer sizes, leading to an out-of-bounds write during index creation. A database user can trigger memory corruption via crafted IVFFlat builds, potentially escalating to arbitrary code execution. 64-bit builds are not impacted. 👉Affected: pgvector < 0.8.6 | Upgrade to 0.8.6
Post summary
pgvector's IVFFlat index on 32‑bit systems triggers an integer wraparound that results in an out‑of‑bounds write during index creation, potentially leading to arbitrary code execution; upgrading to version 0.8.6 mitigates the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pgvector_project | pgvector | - | postgresql | - |