pgvector EUVD-2026-91044

Requires an authenticated database user (PR:L) with privileges to create/build a pgvector index or insert into one on a vector column, on an instance running pgvector before 0.8.7 with the extension installed. The specific trigger is supplying a vector whose dimensionality does not match the index's expected dimensions; the vulnerable versions lack the HnswCheckDim validation on the insert/build/scan paths, so the mismatched input reaches the out-of-bounds write. Limiting factors: valid database credentials and the pgvector extension are mandatory, there is no unauthenticated path, and SSVC rates it non-automatable - making multi-tenant/shared-database deployments where untrusted users hold table or index privileges the realistic risk surface. Note the description/source discrepancy over IVFFlat vs. HNSW affects which exact index operation triggers it.

This is a genuine high-priority issue for environments running pgvector, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges - i.e. any authenticated database user with the ability to create/build an index or insert vector data - yielding high confidentiality, integrity, and availability impact (8.8). The CWE-787 out-of-bounds write leading to arbitrary code execution is corroborated by the vendor commit, which adds missing dimension-validation (HnswCheckDim) on the insert/build/scan paths, so the technical-impact=total SSVC rating is well supported. However, the SSVC framework rates Exploitation=none and Automatable=no, no POC is present in the data, there is no CISA KEV listing, and no EPSS probability was supplied - so there is no evidence of real-world exploitation and automated mass-exploitation is unlikely given the authenticated prerequisite. Net: a real patch-now item for pgvector operators because a low-privileged tenant can escalate to RCE in the PostgreSQL backend, but it is not a drive-by internet threat. One conflict to flag explicitly: the description attributes the flaw to 'IVFFlat index build,' yet the referenced fix (commit ee00d39) exclusively modifies HNSW code paths (hnsw.c/hnswbuild.c/hnswinsert.c/hnswscan.c) - verify the actually-affected index type with the vendor advisory before scoping remediation.

A low-privileged but authenticated tenant on a shared PostgreSQL instance (e.g. a multi-tenant SaaS backend using pgvector for embeddings) creates a vector column and inserts or indexes a vector whose dimensionality is crafted to not match the index's expected dimensions. Because the vulnerable version omits the dimension check, the mismatched value drives an out-of-bounds write during tuple insertion/index build, corrupting backend memory and enabling arbitrary code execution in the PostgreSQL server process. No public exploit identified at time of analysis, and exploitation requires valid database credentials.