{"schema":"threatline.record/2","record":{"id":"CVE-2026-116489","aliases":[],"summary":"Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes","details":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.","categories":["Unclassified"],"product":"pgvectorscale","vendor":"timescale","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116489","source_modified_at":"2026-10-26T14:59:38.170Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"pgvectorscale","vendor":"timescale","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"0.9.1"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116489","source_modified_at":"2026-10-26T14:59:38.170Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"pgvectorscale","ecosystem":null},"version":"0.9.1","basis":"first unaffected version stated in the CVE record"}],"cvss":7.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T14:59:38.170Z","modified_at":"2026-10-26T14:59:38.170Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116489","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T14:59:38.170Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/pull/280","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81","tags":["patch"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa","tags":["patch"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd","tags":["patch"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale/releases/tag/0.9.1","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/timescale/pgvectorscale","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T14:59:38.170Z","content_hash":"64314572f34d8070853547fe23a392efdb52cacb61e473d1f7c61f8dd43726d5"}}