CVE-2026-103484: pgvector IVFFlat Index RCE Vulnerability

CVE-2026-103484 Overview

CVE-2026-103484 is an out-of-bounds write vulnerability [CWE-787] in pgvector, the open-source vector similarity search extension for PostgreSQL. The flaw resides in the IVFFlat index build routine and affects all versions prior to 0.8.7. A database user with privileges to create an index on a vector column can trigger an out-of-bounds write, which can lead to arbitrary code execution within the PostgreSQL server process.

Because pgvector is widely deployed as the storage backend for embeddings in retrieval-augmented generation (RAG) and large language model (LLM) pipelines, this issue affects AI and analytics workloads running on PostgreSQL.

Critical Impact
An authenticated database user can corrupt memory during IVFFlat index construction and achieve arbitrary code execution in the context of the PostgreSQL server process.

Affected Products

pgvector extension for PostgreSQL, all versions prior to 0.8.7
PostgreSQL deployments using the IVFFlat index type on vector columns
Managed and self-hosted database services bundling vulnerable pgvector builds

Discovery Timeline

2026-10-01 - CVE-2026-103484 published to the National Vulnerability Database
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-103484

Vulnerability Analysis

pgvector provides two index types for approximate nearest neighbor search: HNSW and IVFFlat. During IVFFlat index construction, pgvector processes vectors supplied from the underlying table and writes intermediate structures into page buffers. The vulnerable code path does not sufficiently validate vector dimensionality or size constraints before writing, allowing data to be written past the bounds of the destination buffer.

An attacker who can insert rows into a table and build an IVFFlat index on a vector column can shape the written data to corrupt adjacent memory. Because PostgreSQL extensions execute inside the backend process, successful exploitation yields code execution with the privileges of the PostgreSQL service account.

Root Cause

The root cause is missing bounds enforcement during IVFFlat index build, classified as an out-of-bounds write [CWE-787]. The patch in version 0.8.7 hardens the index entry points by threading dimension metadata through additional parameters and adding a type-specific dimensions callback to the HnswTypeInfo structure, enabling the extension to validate vector dimensions at the correct stage of index construction.

Attack Vector

Exploitation requires network access to PostgreSQL and authenticated database credentials with the ability to create or rebuild an IVFFlat index on a vector column. No user interaction is required. The attack succeeds against the backend process regardless of client application logic, because the vulnerable code runs server-side during index build operations.

// Patch excerpt from src/hnsw.c - adds dimension parameter to metadata lookup
 	genericcostestimate(root, path, loop_count, &costs);
 
 	index = index_open(path->indexinfo->indexoid, NoLock);
-	HnswGetMetaPageInfo(index, &m, NULL);
+	HnswGetMetaPageInfo(index, &m, NULL, NULL);
 	index_close(index, NoLock);

// Patch excerpt from src/hnsw.h - adds a dimensions callback for per-type validation
 typedef struct HnswTypeInfo
 {
 	int			maxDimensions;
+	Datum		(*dimensions) (PG_FUNCTION_ARGS);
 	Datum		(*normalize) (PG_FUNCTION_ARGS);
 	void		(*checkValue) (Pointer v);
 }			HnswTypeInfo;

Source: pgvector commit ee00d39

Detection Methods for CVE-2026-103484

Indicators of Compromise

PostgreSQL backend process crashes or SIGSEGV entries in the server log coinciding with CREATE INDEX ... USING ivfflat statements
Unexpected child processes spawned by the PostgreSQL service account following index build operations
pg_extension entries showing pgvector versions below 0.8.7 on production clusters

Detection Strategies

Query pg_extension and pg_available_extensions across all databases to inventory pgvector installations and identify versions earlier than 0.8.7
Audit PostgreSQL logs for IVFFlat index creation statements issued by non-administrative roles, particularly on tables that accept external vector input
Monitor for anomalous outbound network connections or shell invocations originating from the PostgreSQL process

Monitoring Recommendations

Enable log_statement = 'ddl' to capture all CREATE INDEX operations touching vector columns
Alert on PostgreSQL backend crashes and correlate timestamps with recent DDL activity
Track process lineage from postgres worker processes to detect post-exploitation child processes

How to Mitigate CVE-2026-103484

Immediate Actions Required

Upgrade pgvector to version 0.8.7 or later on every PostgreSQL instance where the extension is installed
Revoke CREATE privileges on schemas containing vector tables from untrusted database roles until patching is complete
Review which roles have been granted the ability to create indexes on vector columns and restrict to administrative accounts

Patch Information

The fix is contained in pgvector commit ee00d39ab30c2a7cf9510abf9288c624d91db156 and released in version 0.8.7. The patch adds a dimensions callback to the HnswTypeInfo structure, extends HnswGetMetaPageInfo with an additional metadata parameter, and hardens entry points for IVFFlat index construction. See the pgvector commit and the GitHub issue #1036 discussion for full technical context.

Workarounds

Disable creation of IVFFlat indexes by low-privilege roles via REVOKE CREATE on affected schemas
Where feasible, replace IVFFlat indexes with HNSW indexes until the upgrade is applied, acknowledging that HNSW uses different code paths
Isolate PostgreSQL instances running vulnerable pgvector versions behind network segmentation and strict firewall rules

bash

# Upgrade pgvector and reload the extension in each database
git clone --branch v0.8.7 https://github.com/pgvector/pgvector.git
cd pgvector && make && sudo make install

# Then, for each database using pgvector:
psql -d your_database -c "ALTER EXTENSION vector UPDATE TO '0.8.7';"

# Verify the installed version
psql -d your_database -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'vector';"