The flaw is a buffer overflow caused by an integer wraparound during the construction of an IVFFlat index in the pgvector extension. The wraparound allows a database user to write data beyond the bounds of allocated memory, potentially enabling the execution of arbitrary code. The vulnerability is classified with a CVSS score of 8.8 and is listed as a high‑severity flaw, but its EPSS score is below one percent, indicating a low likelihood of active exploitation at present.

pgvector extensions before version 0.8.6 running on 32‑bit PostgreSQL deployments are affected. The issue does not exist on 64‑bit builds or in later releases.

The likely attack vector is a database user with permission to create IVFFlat indices on a 32‑bit system, which is inferred from the description of the vulnerability, but the exact level of privilege required is not explicitly stated. A memory corruption during index construction provides an attacker with the possibility to execute code with the database process’s privileges. Although the CVSS score is high, the very low EPSS and absence from the CISA KEV list suggest that exploitation is unlikely in the wild at this time. Nevertheless, the potential impact warrants prompt remediation.