CVE-2026-103484 in pgvector
Summary
by MITRE • 10/01/2026
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified within the IVFFlat index implementation of the pgvector extension prior to version 0.8.7 represents a critical memory safety issue that fundamentally compromises the integrity and security of PostgreSQL databases utilizing this specific indexing mechanism. The core technical flaw stems from an improper boundary check during the construction phase of the inverted file flat (IVF) index, which is designed to facilitate efficient approximate nearest neighbor searches on high-dimensional vector data. When a database user initiates the creation or rebuilding of such an index, the underlying C code fails to correctly validate array indices against allocated memory buffers. This oversight allows for out-of-bounds writes, where data intended for one part of the memory structure is erroneously written into adjacent, unprotected memory regions. In systems programming languages like C, which pgvector relies upon for performance-critical operations, such buffer overflows are among the most severe classes of vulnerabilities because they provide a direct pathway to control program execution flow.
The operational impact of this vulnerability is profound, particularly in multi-tenant database environments or applications where users have permission to create custom indexes on shared tables. An attacker with access to execute SQL commands can craft specific vector data and index creation queries that trigger the memory corruption flaw. By carefully manipulating the input vectors and parameters, it is possible to overwrite critical program structures such as function pointers, return addresses, or other control flow metadata stored in adjacent memory locations. This capability effectively allows for arbitrary code execution with the privileges of the database server process. Consequently, this can lead to a complete compromise of the underlying operating system, enabling data exfiltration, persistence mechanisms, lateral movement within the network, and denial of service through application crashes or instability. The severity is exacerbated by the fact that index building often requires elevated permissions, meaning successful exploitation grants the attacker high-level access to the database engine itself.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and more specifically CWE-787 Out-of-bounds Write when data is written beyond the allocated boundary. In terms of adversary behavior mapping according to MITRE ATT&CK, exploitation of this flaw falls under T1203 Exploitation for Execution, as it leverages a software vulnerability to execute malicious code on the target system. It also relates to T1059 Command and Scripting Interpreter if the attacker uses SQL-based techniques to chain further exploits after gaining initial access via the buffer overflow. The attack vector is primarily local or network-accessible depending on whether the database port is exposed, but it requires authentication as a user with CREATE INDEX privileges, which limits its scope compared to unauthenticated remote code execution vulnerabilities yet remains highly dangerous in trusted internal networks.
Mitigation strategies must prioritize immediate patching of the pgvector extension to version 0.8.7 or later, where these boundary checks have been rigorously implemented and validated by developers. Database administrators should also enforce strict least-privilege principles, ensuring that only authorized service accounts possess the ability to create indexes on sensitive tables containing vector data. Additionally, deploying runtime application self-protection tools or memory safety monitors can help detect anomalous memory access patterns indicative of exploitation attempts. For environments where immediate patching is not feasible due to compatibility constraints, restricting network access to the database port and auditing SQL logs for unusual index creation activities involving large vectors serve as effective compensating controls until the software update can be applied.