Loading story…
A high-severity vulnerability, CVE-2026-18022, was disclosed in pgvector affecting version 0.8.5 and earlier. The flaw is an integer wraparound during IVFFlat index building on 32-bit systems that can trigger an out-of-bounds write. According to the disclosure, a database user with the ability to create an IVFFlat index could potentially achieve arbitrary code execution, with the issue mapped to CWE-190 and CWE-787.
The bug was fixed in pgvector 0.8.6, and maintainers advised users running the extension on 32-bit platforms to upgrade. Public reporting credits 0xJi3F with discovering the issue. Severity data published with the CVE lists a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while the accompanying assessment said there was no known exploitation at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry was published for an integer wraparound vulnerability in pgvector before version 0.8.6 affecting IVFFlat index building on 32-bit systems. The entry describes potential out-of-bounds writes and possible arbitrary code execution, with no known exploitation noted.
The disclosure states that CVE-2026-18022 affects pgvector 0.8.5 and earlier and was fixed in version 0.8.6. Users on 32-bit systems were advised to upgrade.
The vulnerability disclosure for CVE-2026-18022 credits 0xJi3F with discovering an integer wraparound flaw in pgvector's IVFFlat index build on 32-bit systems that can lead to out-of-bounds writes and possible arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for two database-related vulnerabilities affecting **PostgreSQL** and **PgBouncer**, both tied to integer handling errors that can destabilize services. **CVE-2026-6473** describes a PostgreSQL server flaw in which allocations can be undersized because of integer wraparound, while **CVE-2026-6664** affects PgBouncer network packet parsing and is classified as an integer overflow issue under **CWE-190**. The PgBouncer flaw carries a **CVSS v3.1 score of 7.5** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating a remotely exploitable issue that requires no privileges or user interaction and can cause a high availability impact, including denial of service. Microsoft released the PgBouncer notice on May 10 and later updated it, while the PostgreSQL advisory was published on May 16, signaling active vendor attention to memory-allocation and packet-parsing weaknesses in widely used database infrastructure components.
Jun 29, 2026
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026
PostgreSQL has released security updates for all supported branches after fixing **28 vulnerabilities**, including several high-severity flaws that could lead to remote code execution or full compromise of database instances. Patched versions are **14.24**, **15.19**, **16.15**, **17.11**, and **18.6**. Among the most serious issues are **`CVE-2026-14662`**, an out-of-bounds write involving the `tsvector` and `tsquery` data types, and **`CVE-2026-18408`**, which can enable code execution during the database restore process. Additional high-impact bugs disclosed in the same release include **`CVE-2026-14669`**, a heap buffer overflow in `to_char(timestamptz)` triggered by long POSIX timezone abbreviations and rated **CVSS 8.8**, and **`CVE-2026-14679`**, an argument-matching flaw that permits controlled out-of-bounds writes on the stack and carries a **CVSS 8.2** score. Successful exploitation of these vulnerabilities could allow attackers to execute code as the operating-system user running PostgreSQL. PostgreSQL said it had no reports of active exploitation at publication time and also warned that support for **PostgreSQL 14** ends on **November 12, 2026**, after which it will no longer receive security fixes.
Aug 20, 2026