Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
pgvector can let attackers run code via crafted index
published 26 days ago
Summary
If a database user can create a special IVFFlat index in pgvector, they could cause the database to execute malicious code. This risk affects the pgvector extension for PostgreSQL versions 13 through 16 on SUSE. Upgrade pgvector to version 0.8.7 to protect your system.
What to do
- Update suse pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql13-pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql14-pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql15-pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql16-pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql17-pgvector to version 0.8.7-160000.1.1.
- Update suse postgresql18-pgvector to version 0.8.7-160000.1.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 16.0 | suse | pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql13-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql14-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql15-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql16-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql17-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | postgresql18-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql13-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql14-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql15-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql16-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql17-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | postgresql18-pgvector |
< 0.8.7-160000.1.1 Fix: upgrade to 0.8.7-160000.1.1
|
Original advisory text
Security update for pgvector
This update for pgvector fixes the following issue:
- CVE-2026-103484: database users with the ability to create an IVFFlat index can write data out-of-bounds, which can
lead to arbitrary code execution (bsc#1284129).
Changes for pgvector:
- Updated to version 0.8.7
- CVE-2026-103484: database users with the ability to create an IVFFlat index can write data out-of-bounds, which can
lead to arbitrary code execution (bsc#1284129).
Changes for pgvector:
- Updated to version 0.8.7
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202624211-1/ Vendor Advisory
- https://bugzilla.suse.com/1284129 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-103484 URL
Timeline
Published9 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
SUSE-SU-2026:24211-1 · OSV
Track software like this
Free during beta