Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116489— Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes

Quick assessment

Affected
timescale pgvectorscale
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Timescale pgvectorscale 在 0.9.1 之前的版本中存在类型混淆漏洞，允许低权限数据库用户通过伪造 pgvector 的向量类型或算子来破坏内存。拥有 vectorscale 模式上 CREATE 权限的攻击者可以预先创建伪造对象，随后针对精心构造的值构建并查询 DiskANN 索引，从而引发越界读写，导致内存泄露、服务器崩溃或权限提升。

CVSS 7.5 · High EPSS 0.50% · P42

Affected Version Matrix 1

VendorProduct Version RangeStatus
timescale pgvectorscale < 0.9.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116489

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
Source: CVE Program / CVE List V5
Vulnerability Description
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
timescale pgvectorscale 0 ~ 0.9.1 -

II. Public POCs for CVE-2026-116489

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116489

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116489 (4)

Vendor Advisories for CVE-2026-116489 (1)

Vendor Pages for CVE-2026-116489 (1)

Other References for CVE-2026-116489 (2)

IV. Related Vulnerabilities

Same vendor: timescale
Same weakness: CWE-843