pgvector 0.8.7 fixes a code-execution risk in index builds
pgvector 0.8.7 fixes a buffer overflow in IVFFlat index construction. The project says a database user who can create this kind of vector-search index could write outside allocated memory, potentially executing arbitrary code. Versions 0.8.6 and earlier are affected, making this a security upgrade for existing installations rather than a new search feature.
pgvector · Oct 5, 2026
Why it matters
Applications using PostgreSQL for vector search should check their installed extension version and upgrade path.
More context
Prioritize upgrading affected installations through your usual package or managed-service process. The maintainer advisory identifies CVE-2026-103484 and the required index-creation capability; the release announcement is dated October 5.
Keep in mind
The advisory describes a potential exploit, not evidence that your database was compromised. 1min has not reproduced the vulnerability or tested an upgrade.
Original read