CVE-2026-18022

Name of the Vulnerable Software and Affected Versions pgvector versions prior to 0.8.6

Description An integer wraparound occurs during the IVFFlat index build process on 32-bit systems. This issue allows a database user to perform an out-of-bounds write, which could potentially lead to arbitrary code execution. Integer wraparound is a condition where an arithmetic operation results in a value too large for the designated integer type, causing it to wrap around to a minimum or negative value.

Recommendations Update pgvector to version 0.8.6 or later.