{"id":"CVE-2026-103484","summary":"pgvector buffer overflow in IVFFlat index build","details":"IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.","modified":"2026-10-04T07:04:37.140059Z","published":"2026-10-01T19:49:03.670Z","database_specific":{"cwe_ids":["CWE-1284","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103484.json","unresolved_ranges":[{"extracted_events":[{"fixed":"0.8.7"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"fixed":"0.8.7"}]}],"cna_assigner":"PostgreSQL"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103484.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103484"},{"type":"REPORT","url":"https://github.com/pgvector/pgvector/issues/1036"},{"type":"FIX","url":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pgvector/pgvector","events":[{"introduced":"0"},{"fixed":"ee00d39ab30c2a7cf9510abf9288c624d91db156"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.2","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.2","v0.3.1","v0.3.0","v0.2.7","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"ivfflat_halfvec_support"},"deprecated":false,"digest":{"function_hash":"228859413501596896409903108063119028081","length":258},"id":"CVE-2026-103484-038622a8"},{"digest":{"length":212,"function_hash":"34528154703028778832069458557435262646"},"id":"CVE-2026-103484-07479772","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"function":"HalfvecSumCenter","file":"src/ivfutils.c"},"deprecated":false},{"digest":{"line_hashes":["9487684956705853954346511495788068005","66129849463501736420542930987666102484","132650639596009071409432280101770453329","148032643669541073940703009226306781377","9570953750977691628429558085777251543","18024245980937134387986820842987186941","175156099297544159649663164057661980579","1284990986512547130748549685854383292","111639664498270080949585843507618035844","116434586577140633210540248555229145950","35469550145215003019433116559093020015","210009663941897276673875993830394057271"],"threshold":0.9},"id":"CVE-2026-103484-08e946f5","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfinsert.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfbuild.c","function":"AddTupleToSort"},"deprecated":false,"digest":{"function_hash":"25401944635381592564318510588588444732","length":1096},"id":"CVE-2026-103484-170412a0","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c"},"deprecated":false,"digest":{"line_hashes":["139035616233833529531107511565026235771","199296134974666220696927506913452315659","201729524887738765357278447332549955566","71356511285209668829670380190745025436","47833846455636026783005289659998033875","196657106354332187820158064775900550365","187605485431985105170570728700157479076","12060027300451103623659932172979604857","313930614194535433832551065437242013476","4669837816367359309976247387977112462","282262241639011710752407383293111879330","60381143121911574350230310014631608026","69324497522101573103828581382377586815","198438401992527019594187387637434658890","188393710713249744985672935455541485917","164254001990899509132147845345076655758","184979284988728682170325444823552912469","255758886874838014131145188813597384343","290940317266237020521145689207547864522","100698835458453868676899207123793248452","48615757451528497717085009750696875164","74008898736583611087698428790710255975","44785200555173294775718138424432829851","28897514504552165988225081565162712131","289405681967261309373744911344019631198","2152528078436135543749728039113509887","231753396890645000621267231406133072955","245475374597336265938608910547495441350","33272976750414357860609479198032597890","321531962027312056667262280326365039906","159290952159525599036324177444688926409","49186764166091791135041008362952077424","210984866218135552597728862411782148685","46896719383821421089897810026808545378","41842692134783908900881351062393715654","61253169183631227495304038251603440696","104946259262046851840436328575802356611","22870693259240469067579868530431994064","198027224283847083586581529267680947462","178287882912843054753936875332509542071","84465503078560756569883283719861562435","8155919510408297058557623721686362780","117492224030067861787149950940480628108","194483982037179237780610163510895041136","8240882148689781552351462736958380713"],"threshold":0.9},"id":"CVE-2026-103484-18ecfb40","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnsw.h"},"deprecated":false,"digest":{"line_hashes":["176625646273921310947691989209107316107","211726432912114169664636747915951623498","289160494670392470056700933778950827558","282246798542363459870823444840421909499","337415686907628903323211678115151145437","54258195377627204341175466146881082985","172616514923668368565510035348123624956","259995591026637131950816635497052900713","36288823367164332381225121545920216926","19034302635339417208809881562882668525","286401219054796587792530615799668165260","201442626758215667708206836934456807739","140297208488225079772212736620191382737","130905284080837719127207143457785401917","219219161413675331283334361972310398315","152067601601935746472541442990139953605"],"threshold":0.9},"id":"CVE-2026-103484-1c63b220"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"IvfflatGetTypeInfo"},"deprecated":false,"digest":{"function_hash":"152120748444542523373863826930978813241","length":413},"id":"CVE-2026-103484-2313c900","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["312516490941416641830956082741145622444","277810089375323758281093581863753981143","100044606646128676928595537946950751005","23267413209372226336467590798448359043","107861238807967480660061586394472081518","240552218857749572673892466501955784422","255456681764920094864882957977903954236","91497018168041424321822300128103787976","140039236462826547112020771763786224640","297496871164564351560919468743453947678","235974335730274756343230677818197826713"],"threshold":0.9},"id":"CVE-2026-103484-2c20ce25","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswbuild.c"}},{"deprecated":false,"digest":{"line_hashes":["78294074136107309294506269321187983229","244464955301381677845085246917326885169","155566231075943736860029744976111225235","202282121189852939407890034498190255840"],"threshold":0.9},"id":"CVE-2026-103484-2f9b935d","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfscan.c"}},{"source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"VectorSumCenter"},"deprecated":false,"digest":{"function_hash":"289649478483937878122049246130416517216","length":199},"id":"CVE-2026-103484-30c3e96b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/hnswutils.c","function":"hnsw_sparsevec_support"},"deprecated":false,"digest":{"function_hash":"238593038448828705347504023796561044946","length":192},"id":"CVE-2026-103484-37f214b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswinsert.c","function":"HnswInsertTuple"},"deprecated":false,"digest":{"length":299,"function_hash":"219597625269159000554979371488533103895"},"id":"CVE-2026-103484-3bbbd8ca","signature_type":"Function"},{"digest":{"function_hash":"258432269649166998189723890599535129218","length":247},"id":"CVE-2026-103484-3bbda044","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"BitSumCenter"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswbuild.c","function":"InsertTuple"},"deprecated":false,"digest":{"function_hash":"275551388269309986894732071888136020389","length":1589},"id":"CVE-2026-103484-5706df2c"},{"target":{"file":"src/ivfscan.c","function":"GetScanValue"},"deprecated":false,"digest":{"function_hash":"158678753659655586742808801730903018172","length":567},"id":"CVE-2026-103484-5bb3935f","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156"},{"source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c","function":"HnswGetTypeInfo"},"deprecated":false,"digest":{"function_hash":"140600872388268023006915745660195125880","length":329},"id":"CVE-2026-103484-6052afc1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfkmeans.c","function":"CheckElements"},"deprecated":false,"digest":{"function_hash":"305029638298470608181424546158894306625","length":549},"id":"CVE-2026-103484-695d2951","signature_type":"Function"},{"id":"CVE-2026-103484-6d5a5d1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"IvfflatNormVectors"},"deprecated":false,"digest":{"function_hash":"160170857675764222706644151095590335284","length":361}},{"deprecated":false,"digest":{"line_hashes":["286097864026030833854796969978972768560","6500328918187374367107331982718590273","129213252616651219993599272564372144841","147587257141688236675365537968428392979"],"threshold":0.9},"id":"CVE-2026-103484-6dd69524","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswvacuum.c"}},{"deprecated":false,"digest":{"function_hash":"55985847935105752651930541951152872530","length":1915},"id":"CVE-2026-103484-77d05e63","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfinsert.c","function":"InsertTuple"}},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfkmeans.c"},"deprecated":false,"digest":{"line_hashes":["37571224192940317088817628907520298039","132115047567795905475831961861904988882","170289490527605791176072131042723299909","91310898210016614428415219251591797631","306251152362819700303434761684175544643","235484026783715803566585364072942185736","195453392342970404154243853646688095963","144045446245588466663354676890799763044"],"threshold":0.9},"id":"CVE-2026-103484-7821c8bf","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnsw.c","function":"hnswcostestimate"},"deprecated":false,"digest":{"function_hash":"263613725562163594166097381003188346316","length":1540},"id":"CVE-2026-103484-7c4e5384","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfutils.c","function":"ivfflat_bit_support"},"deprecated":false,"digest":{"function_hash":"294289371872102668135695724008165663169","length":231},"id":"CVE-2026-103484-840c9089"},{"source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfflat.h"},"deprecated":false,"digest":{"line_hashes":["197428721683609737201758526187344557162","121265031948273887730562415110969965750","244015121630968421197701271440050459630","32847611822922678779762322542714753320","97128712365082315767205683054329713674","216093148793627880825939361813952648978","233154063263941004213651659166697531463","262964034873802392509540641665246070802","288885547455018067936428700923529947206","59150950059558018353598470190658151792","275261262486240608108606672444718592824","271678666167557191132864788281099966676"],"threshold":0.9},"id":"CVE-2026-103484-854f3d4f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"100597807639743794946633098779940739443","length":95},"id":"CVE-2026-103484-8683047a","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c","function":"HnswGetEntryPoint"}},{"deprecated":false,"digest":{"line_hashes":["5374338003914907933528038950282334544","319335788211636575885422552773628556694","81821844370500895344170123051442620848","55710757270189732846096318818232390919","321760902763313879263849821823638861744","269668017174116499980564372804720162848"],"threshold":0.9},"id":"CVE-2026-103484-8f768a97","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfbuild.c"}},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswscan.c"},"deprecated":false,"digest":{"line_hashes":["337779410351670281060424473654369793420","160613759969030661483287200258402884765","111496395962590981143219809440610755514","46653169439238995131451063424310087824","33220042336057342220291133483490347443","131266270720498535448931363039583309772","270367543607049613853921821156634001870","268878784758509917936077350526657814551"],"threshold":0.9},"id":"CVE-2026-103484-9a23fdbf","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/sparsevec.c"},"deprecated":false,"digest":{"line_hashes":["122343753931351170365789102725026451083","131468138741926071606123915428044602041","315200924861609307434202241365694447113"],"threshold":0.9},"id":"CVE-2026-103484-9afbbab6"},{"id":"CVE-2026-103484-a7e30d3e","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c","function":"HnswGetMetaPageInfo"},"deprecated":false,"digest":{"length":609,"function_hash":"170977691184427589932536419719792979046"}},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswscan.c","function":"GetScanItems"},"deprecated":false,"digest":{"function_hash":"276184923627329624672516406930996830963","length":828},"id":"CVE-2026-103484-a9d8e4d2","signature_type":"Function"},{"digest":{"function_hash":"182643035325812610803315101062850697939","length":894},"id":"CVE-2026-103484-aa467159","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfbuild.c","function":"AddSample"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"204805014947355578065901050317005741480","length":159},"id":"CVE-2026-103484-b6519a21","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c","function":"hnsw_bit_support"}},{"digest":{"line_hashes":["219524402528731714261182425553906573394","82030922340112787889585806893645441783","207843166062776188375450234272257669062","55816153579298054828557189689958410515"],"threshold":0.9},"id":"CVE-2026-103484-bb5a6a6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnsw.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["152086582340484283429383755812047741608","153969794090573245013810180497262039246","334616315302886085160111116417918422979","325744055674170568844532368261636456554","109442063345218644415059705352484326390","109312460828238531152533947218620221854","234607265877768105179441925891740189120","239690033807369646525332042009529873151","319150172934225283146650897375098982249","29974207023707597174146849795517436171","328440809181802732363573842001448706341","103516015567956033524329721001997065626","30893023399456407222784707762286334279","233171533891828796317444873278913639484","4811888535762434014329654750999604047","281351705690748177392961325358656473130","313930614194535433832551065437242013476","202431640671053552861492679389710661148","146115266585918645033128364955280077378","338936312953569371800048519701235894412","106246551433153130792541072215093363706","20410150064018971864369398163947974552","301978885936438723449344320231269601534","61689985066478518955657398221395955332","168132880455440775244253078734148742267","252323706208306876761060167783037623731","154761247184986502462860781508274420265","8552632359278453061020818232572966239","190925455269119980813625207066297609138","242374022193119547422177764616863407381","304331404643129682156564171132222079083","270712222975079844050141177931660576415","249392897229212823479569687919243382329","252457294337008830655702623997425899002"],"threshold":0.9},"id":"CVE-2026-103484-d333638a","signature_type":"Line","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c"}},{"digest":{"function_hash":"294924184915722089910176852707473674517","length":817},"id":"CVE-2026-103484-d9e55051","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswinsert.c","function":"HnswInsertTupleOnDisk"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"171822000780454147924587480032831606431","length":277},"id":"CVE-2026-103484-de38fbf1","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/ivfkmeans.c","function":"SumCenters"}},{"id":"CVE-2026-103484-e38eba55","signature_type":"Function","signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswutils.c","function":"hnsw_halfvec_support"},"deprecated":false,"digest":{"function_hash":"313076654661070177255085298220110830175","length":174}},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"file":"src/hnswinsert.c"},"deprecated":false,"digest":{"line_hashes":["43502181898190450614558297150703362954","331504891230047885833703621225496013546","296882191043353968382098177329387831127","267836585980708818667700848223585807075","53040425307195228912905435691967532359","115168198214788358160061387884040504965","180659636730940124845092860086452210846","326861835357372779768190734959038816570","127224393049620631112640225613420076396","17761957537282093156332958104602772985","244190374733438367185196786258520844744","42590204185554615908228059203777281773","316699339058829245311211342745237271895","269061174282463829728898159952554455432","24427664893785945922836011473582931727","17374334164199835453853708174918698139","238162393303923898786088998691469323357"],"threshold":0.9},"id":"CVE-2026-103484-f65e270d","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156","target":{"function":"InitVacuumState","file":"src/hnswvacuum.c"},"deprecated":false,"digest":{"length":682,"function_hash":"189542940737061988394829403212060896706"},"id":"CVE-2026-103484-f89c869b","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103484.json","vanir_signatures_modified":"2026-10-04T07:04:37Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}