{"id":"CVE-2026-103484","published":"2026-10-01T20:17:23.213","lastModified":"2026-10-02T18:53:46.583","description":"IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787","CWE-1284"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","tags":[]},{"url":"https://github.com/pgvector/pgvector/issues/1036","tags":[]}],"exploitRefs":[{"url":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","tags":[]},{"url":"https://github.com/pgvector/pgvector/issues/1036","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw allows a database user to write data out-of-bounds in the IVFFlat index build process, potentially leading to arbitrary code execution. This is significant because it can enable attackers to gain full control over the database system.","exploitability":"Exploitation requires a user with database write permissions and knowledge of the affected version. The attacker must trigger the IVFFlat index build process.","blast_radius":"If exploited, the impact could be severe, as it allows arbitrary code execution, potentially leading to full system compromise.","remediation":"Upgrade to pgvector 0.8.7 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","db","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:53:22.523Z"}}