Type Confusion Vulnerability in Timescale pgvectorscale Database Product

CVE-2026-116489

What is CVE-2026-116489?

The Timescale pgvectorscale product prior to version 0.9.1 is impacted by a type confusion vulnerability that can lead to serious security issues. This flaw permits low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators when they have CREATE privilege on the vectorscale schema. By pre-creating shadow objects, attackers can exploit this vulnerability to build and query DiskANN indexes over specially crafted values, which may result in out-of-bounds reads and writes. These exploits could disclose sensitive memory contents, crash the database server, or potentially escalate user privileges, compromising the integrity and availability of the system.

References