{"id":"CVE-2026-116489","title":"Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes","summary":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-843"],"vendor":"timescale","product":"pgvectorscale","affected":["pgvectorscale < 0.9.1"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:59:38.170Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116489","references":[{"url":"https://github.com/timescale/pgvectorscale/pull/280","label":"Pull Request #280"},{"url":"https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81"},{"url":"https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa"},{"url":"https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd"},{"url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231"},{"url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151"},{"url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253"},{"url":"https://github.com/timescale/pgvectorscale/releases/tag/0.9.1","label":"pgvectorscale 0.9.1 Release Notes"},{"url":"https://github.com/timescale/pgvectorscale"},{"url":"https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes","label":"VulnCheck Advisory: Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.504Z","slug":"CVE-2026-116489","body":"## Overview\n\nTimescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.\n\n## Affected\n\n- `pgvectorscale < 0.9.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}