CVE-2026-3172 Details
Description
Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.
A buffer overflow vulnerability has been identified in pgvector versions 0.6.0 through 0.8.1. This issue arises during the parallel construction of HNSW indexes, where integer wraparound can be exploited. A database user with the ability to create or reindex an HNSW index using parallel workers could potentially leak sensitive data from other relations or crash the database server.
Users running an affected version should upgrade to pgvector version 0.8.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 25, 2026CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pgvector/pgvector/issues/959 | PostgreSQL | ExploitIssue TrackingRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | PostgreSQL |
| CWE-787 | Out-of-bounds Write | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| pgvector | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | New CVE Received | PostgreSQL |