🔐 CVE Alert

CVE-2026-116489

HIGH 7.5

Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes

CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

CWE CWE-843
Vendor timescale
Product pgvectorscale
Published Oct 26, 2026
Stay Ahead of the Next One

Get instant alerts for timescale pgvectorscale

Be the first to know when new high vulnerabilities affecting timescale pgvectorscale are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

timescale / pgvectorscale
0 < 0.9.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/timescale/pgvectorscale/pull/280 github.com: https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81 github.com: https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa github.com: https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd github.com: https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231 github.com: https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151 github.com: https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253 github.com: https://github.com/timescale/pgvectorscale/releases/tag/0.9.1 github.com: https://github.com/timescale/pgvectorscale vulncheck.com: https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes

Credits

Mehmet Ince