CVE-2026-116489

Name of the Vulnerable Software and Affected Versions pgvectorscale versions prior to 0.9.1

Description A type confusion issue allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Users with CREATE privilege on the vectorscale schema can pre-create shadow objects and then build and query DiskANN indexes over crafted values. This process can lead to out-of-bounds reads and writes, resulting in memory disclosure, server crashes, or privilege escalation.

Recommendations Update to version 0.9.1 or later.