CVE-2026-116489: type confusion enables memory

CISO Take

Timescale pgvectorscale before 0.9.1, the PostgreSQL extension that adds DiskANN indexes to pgvector, has a type confusion flaw (CWE-843). A low-privileged database user with CREATE rights on the vectorscale schema can shadow pgvector's vector type or operators and trigger out-of-bounds reads and writes. The result can be memory disclosure, a server crash, or privilege escalation inside the database host process. Urgency is moderate: there is no KEV listing, no public exploit, no Nuclei template, and no EPSS score yet. The attack needs an authenticated account and high complexity, and it is limited to multi-tenant or shared PostgreSQL deployments where untrusted users hold schema privileges. Upgrade to pgvectorscale 0.9.1 and review who holds CREATE on the vectorscale schema. Prioritize shared vector database clusters that serve RAG workloads.

Sources:NVDATLASVulnCheck advisoryGitHub (timescale/pgvectorscale)

What is the risk?

High severity (CVSS 7.5) but with limited practical exposure. Exploitation needs network access, a valid low-privileged database account, and CREATE privilege on the vectorscale schema, so it is mainly an insider or compromised-credential risk. Impact covers confidentiality, integrity and availability, because memory corruption in the Postgres backend can lead to data disclosure, a crash, or privilege escalation. There is no known exploitation, no public PoC, and no EPSS data, so likelihood is low to moderate today. Exposure grows in shared, multi-tenant, or managed PostgreSQL setups where application developers or tenants can create objects in extension schemas. Confidence in this assessment is MEDIUM, because it rests on the NVD description and the vendor fix commits without independent exploit validation.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged database account with CREATE rights on the vectorscale schema.

AML.T0049

Setup

Attacker pre-creates shadow vector types or operators that mimic pgvector's objects.

Exploitation

Attacker builds and queries a DiskANN index over crafted values, causing type confusion and out-of-bounds memory access.

Impact

Memory disclosure, a server crash, or privilege escalation compromises the database and the AI applications that rely on it.

AML.T0029

Initial Access

Attacker obtains a low-privileged database account with CREATE rights on the vectorscale schema.

AML.T0049

Setup

Attacker pre-creates shadow vector types or operators that mimic pgvector's objects.

Exploitation

Attacker builds and queries a DiskANN index over crafted values, causing type confusion and out-of-bounds memory access.

Impact

Memory disclosure, a server crash, or privilege escalation compromises the database and the AI applications that rely on it.

AML.T0029

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade pgvectorscale to 0.9.1 or later and rebuild existing DiskANN indexes after the upgrade. 2) Revoke CREATE on the vectorscale schema, and on the schema holding pgvector objects, from all non-administrative roles. 3) Audit the vectorscale and public schemas for unexpected shadow types, operators, and operator classes that duplicate pgvector's vector type. 4) Check the search_path and pg_operator and pg_type catalogs for objects created by non-admin roles. 5) Monitor PostgreSQL logs for backend crashes (signal 11 or 6) and unexpected restarts around index builds or DiskANN queries. 6) Run the database service under a least-privileged OS account, with the vector workload isolated from other databases where practical.

How is it classified?

Code ExecutionData LeakageDoSRAGFrameworkAML.T0029- Denial of AI Service AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and supply chain risk management

OWASP LLM Top 10

LLM08-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-116489?

Timescale pgvectorscale before 0.9.1, the PostgreSQL extension that adds DiskANN indexes to pgvector, has a type confusion flaw (CWE-843). A low-privileged database user with CREATE rights on the vectorscale schema can shadow pgvector's vector type or operators and trigger out-of-bounds reads and writes. The result can be memory disclosure, a server crash, or privilege escalation inside the database host process. Urgency is moderate: there is no KEV listing, no public exploit, no Nuclei template, and no EPSS score yet. The attack needs an authenticated account and high complexity, and it is limited to multi-tenant or shared PostgreSQL deployments where untrusted users hold schema privileges. Upgrade to pgvectorscale 0.9.1 and review who holds CREATE on the vectorscale schema. Prioritize shared vector database clusters that serve RAG workloads.

Is CVE-2026-116489 actively exploited?

No confirmed active exploitation of CVE-2026-116489 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-116489?

1) Upgrade pgvectorscale to 0.9.1 or later and rebuild existing DiskANN indexes after the upgrade. 2) Revoke CREATE on the vectorscale schema, and on the schema holding pgvector objects, from all non-administrative roles. 3) Audit the vectorscale and public schemas for unexpected shadow types, operators, and operator classes that duplicate pgvector's vector type. 4) Check the search_path and pg_operator and pg_type catalogs for objects created by non-admin roles. 5) Monitor PostgreSQL logs for backend crashes (signal 11 or 6) and unexpected restarts around index builds or DiskANN queries. 6) Run the database service under a least-privileged OS account, with the vector workload isolated from other databases where practical.

What systems are affected by CVE-2026-116489?

This vulnerability affects the following AI/ML architecture patterns: vector databases, RAG pipelines, semantic search systems, multi-tenant PostgreSQL AI backends.

What is the CVSS score for CVE-2026-116489?

CVE-2026-116489 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.50%.

What is the AI security impact?

Affected AI Architectures

vector databasesRAG pipelinessemantic search systemsmulti-tenant PostgreSQL AI backends

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

Exploitation Scenario

An attacker obtains a low-privileged database account on a shared PostgreSQL cluster that hosts a RAG application, for example through a compromised application credential. Because the account has CREATE on the vectorscale schema, they pre-create a fake vector type or operator class that shadows pgvector's. They then build a DiskANN index over crafted values and run queries against it. The extension treats the attacker's data as a genuine vector, which causes out-of-bounds reads and writes in the Postgres backend. The attacker uses the reads to leak memory contents such as other users' embeddings and document chunks. They then either crash the server to disrupt the AI service or use the writes to escalate privileges.

Weaknesses (CWE)

CWE-843Access of Resource Using Incompatible Type ('Type Confusion')Primary CWE-843Access of Resource Using Incompatible Type ('Type Confusion')

CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion'): The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Source: MITRE CWE corpus.