CVE-2026-116489 Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116489?
CVE-2026-116489 is a high-severity vulnerability in timescale pgvectorscale, published on 26 Oct 2026.
Official description
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.
Weakness: CWE-843
Which versions are affected by CVE-2026-116489?
How do I fix CVE-2026-116489?
No fix has been published for CVE-2026-116489 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116489 being exploited?
There is no known exploitation of CVE-2026-116489 in the wild and no public exploit code.
Sources
Also known as GHSA-p9m3-8942-gxhh.