CVE-2026-18022: pgvector integer wraparound

CISO Take

pgvector before 0.8.6 has an integer wraparound bug in its IVFFlat index build routine that lets a database user write memory out-of-bounds, with the potential to execute arbitrary code — but only on 32-bit PostgreSQL installations. The CVSS 8.8 score looks alarming, and the low bar for exploitation (network access, low privileges, no user interaction) would normally demand immediate action, but the practical blast radius is narrow: virtually all production PostgreSQL deployments today, including managed cloud offerings, run 64-bit, so exposure is limited to legacy or embedded 32-bit installs. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score, indicating no observed exploitation activity. The concrete action is straightforward: confirm your PostgreSQL host architecture, upgrade pgvector to 0.8.6+ regardless, and in the interim restrict CREATE INDEX / table-creation privileges on any database holding vector data to trusted roles only, since exploitation requires at least a low-privileged database account.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High technical severity (CVSS 8.8, network-exploitable, no user interaction) but low real-world exploitability for most organizations because the flaw only manifests on 32-bit systems — an architecture almost extinct in production PostgreSQL/RAG deployments. Exploitation also requires an attacker to already hold a low-privileged database account capable of creating tables/indexes, which raises the bar beyond a pure remote unauthenticated attack. No evidence of active exploitation (not in CISA KEV, no EPSS score, no public PoC or scanner template). Organizations should treat this as 'patch on next maintenance window' unless they specifically run 32-bit PostgreSQL hosts, in which case it becomes urgent.

How does the attack unfold?

Low-Privilege Database Access

Attacker obtains or already holds a low-privileged PostgreSQL account (e.g., a compromised RAG application service account) with rights to create tables and indexes.

Trigger Integer Wraparound

Attacker creates a crafted vector table and initiates an IVFFlat index build designed to overflow an internal integer counter in pgvector's index-build code.

AML.T0010.001

Out-of-Bounds Memory Write

The wraparound causes pgvector to write data outside its allocated buffer during index construction, corrupting PostgreSQL server memory (32-bit systems only).

Arbitrary Code Execution

The memory corruption is leveraged to achieve arbitrary code execution within the PostgreSQL server process, exposing all co-located data including RAG embeddings and source documents.

Low-Privilege Database Access

Attacker obtains or already holds a low-privileged PostgreSQL account (e.g., a compromised RAG application service account) with rights to create tables and indexes.

Trigger Integer Wraparound

Attacker creates a crafted vector table and initiates an IVFFlat index build designed to overflow an internal integer counter in pgvector's index-build code.

AML.T0010.001

Out-of-Bounds Memory Write

The wraparound causes pgvector to write data outside its allocated buffer during index construction, corrupting PostgreSQL server memory (32-bit systems only).

Arbitrary Code Execution

The memory corruption is leveraged to achieve arbitrary code execution within the PostgreSQL server process, exposing all co-located data including RAG embeddings and source documents.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
pgvector	pip	—	No patch
1.5K 317 dependents Pushed 23d ago 67% patched ~13d to patch Full package profile →

Do you use pgvector? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Identify all PostgreSQL instances using pgvector and confirm CPU architecture — 64-bit systems are not vulnerable to the wraparound condition. 2) Upgrade pgvector to 0.8.6 or later on any affected instance regardless of architecture, as a defense-in-depth measure. 3) Apply least privilege: restrict CREATE INDEX / CREATE TABLE / ownership rights on schemas holding vector embeddings to trusted service accounts only, since PR:L is required to trigger the bug. 4) Monitor PostgreSQL logs for unexpected crashes or restarts during index builds, and for anomalous DDL activity from application service accounts. 5) Reference the fix commit (pgvector/pgvector@636a92a) and issue #1006 for technical validation during patch testing.

How is it classified?

Code Execution DoS RAG AML.T0010.001 - AI Software AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.3 - Risks from third-party AI system components are documented and monitored

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-18022?

pgvector before 0.8.6 has an integer wraparound bug in its IVFFlat index build routine that lets a database user write memory out-of-bounds, with the potential to execute arbitrary code — but only on 32-bit PostgreSQL installations. The CVSS 8.8 score looks alarming, and the low bar for exploitation (network access, low privileges, no user interaction) would normally demand immediate action, but the practical blast radius is narrow: virtually all production PostgreSQL deployments today, including managed cloud offerings, run 64-bit, so exposure is limited to legacy or embedded 32-bit installs. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score, indicating no observed exploitation activity. The concrete action is straightforward: confirm your PostgreSQL host architecture, upgrade pgvector to 0.8.6+ regardless, and in the interim restrict CREATE INDEX / table-creation privileges on any database holding vector data to trusted roles only, since exploitation requires at least a low-privileged database account.

Is CVE-2026-18022 actively exploited?

No confirmed active exploitation of CVE-2026-18022 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18022?

1) Identify all PostgreSQL instances using pgvector and confirm CPU architecture — 64-bit systems are not vulnerable to the wraparound condition. 2) Upgrade pgvector to 0.8.6 or later on any affected instance regardless of architecture, as a defense-in-depth measure. 3) Apply least privilege: restrict CREATE INDEX / CREATE TABLE / ownership rights on schemas holding vector embeddings to trusted service accounts only, since PR:L is required to trigger the bug. 4) Monitor PostgreSQL logs for unexpected crashes or restarts during index builds, and for anomalous DDL activity from application service accounts. 5) Reference the fix commit (pgvector/pgvector@636a92a) and issue #1006 for technical validation during patch testing.

What systems are affected by CVE-2026-18022?

This vulnerability affects the following AI/ML architecture patterns: vector databases, RAG pipelines, embedding storage.

What is the CVSS score for CVE-2026-18022?

CVE-2026-18022 has a CVSS v3.1 base score of 8.8 (HIGH).

What is the AI security impact?

Affected AI Architectures

vector databasesRAG pipelinesembedding storage

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

Exploitation Scenario

An attacker who has obtained low-privileged credentials to a RAG application's PostgreSQL backend — for example, via a leaked service-account connection string or an over-permissioned application role — crafts a table with a specially sized vector column and dimension count designed to overflow an internal integer counter when an IVFFlat index is built. On a 32-bit PostgreSQL host, this wraparound causes the index-build routine to write data outside its allocated buffer, corrupting server memory. With careful crafting, this out-of-bounds write can be leveraged to achieve arbitrary code execution within the PostgreSQL server process, giving the attacker a foothold to access all data in the database — including proprietary embeddings, source documents indexed for RAG, and any other tenant data sharing that instance.

Weaknesses (CWE)

CWE-190 Integer Overflow or Wraparound CWE-787 Out-of-bounds Write

CWE-190 — Integer Overflow or Wraparound: The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

[Requirements] Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. If possible, choose a language or compiler that performs automatic bounds checking.

Source: MITRE CWE corpus.