Pgvectorscale
Monthly
Type confusion in Timescale's pgvectorscale extension (all versions before 0.9.1) lets a low-privileged database user who holds CREATE on the vectorscale schema pre-create shadow objects that impersonate pgvector's vector type or operators, then build and query a DiskANN index over crafted values to drive out-of-bounds reads and writes. Successful exploitation can disclose process memory, crash the PostgreSQL server, or escalate privileges within the database; both pgvector and a vulnerable pgvectorscale build must be installed, and the source CVSS 4.0 score of 7.7 reflects full confidentiality, integrity and availability impact confined to the vulnerable system. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor-priority decision is 'this_week' and fixed builds ship in 0.9.1.
Type confusion in Timescale's pgvectorscale extension (all versions before 0.9.1) lets a low-privileged database user who holds CREATE on the vectorscale schema pre-create shadow objects that impersonate pgvector's vector type or operators, then build and query a DiskANN index over crafted values to drive out-of-bounds reads and writes. Successful exploitation can disclose process memory, crash the PostgreSQL server, or escalate privileges within the database; both pgvector and a vulnerable pgvectorscale build must be installed, and the source CVSS 4.0 score of 7.7 reflects full confidentiality, integrity and availability impact confined to the vulnerable system. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor-priority decision is 'this_week' and fixed builds ship in 0.9.1.