---
id: CVE-2026-18022
title: >-
  pgvector: pgvector: Arbitrary Code Execution via Integer Wraparound
  (CVE-2026-18022)
summary: >-
  A flaw was found in pgvector. An integer wraparound vulnerability exists
  during the IVFFlat index build process. This flaw allows a database user on a
  32-bit system to write data outside of allocated memory buffers. Successful
  exploitation…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-787
  - CWE-190
vendor: Red Hat
product: pgvector
affected:
  - pgvector < 0.8.6
published: '2026-07-29'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:44:04+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18022.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18022.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18022'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2508603'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-18022'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18022'
  - url: >-
      https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708ae104
  - url: 'https://github.com/pgvector/pgvector/issues/1006'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00601
epssPercentile: 0.4853
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-30T00:00:00+00:00'
ingestedAt: '2026-10-07T03:28:55.184Z'
---

## Overview

A flaw was found in pgvector. An integer wraparound vulnerability exists during the IVFFlat index build process. This flaw allows a database user on a 32-bit system to write data outside of allocated memory buffers. Successful exploitation could lead to arbitrary code execution.

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18022.json)

**pgvector: pgvector: Arbitrary Code Execution via Integer Wraparound** — rated Important by Red Hat. Released 2026-07-29, updated 2026-10-15.

Not affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 9
- Red Hat Trusted Profile Analyzer

## Remediation

Refer to the advisory for fix availability.