ALSA-2026:88360: Important: postgresql18-pgvector security update

Q: When is this issue likely to be exploitable?

The flaw occurs during IVFFlat index build operations in pgvector. Systems that build IVFFlat indexes are the relevant exposure surface described by the advisory.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in arbitrary code execution through an out-of-bounds write during an IVFFlat index build.

Q: Which package should be updated?

The affected software identified by the advisory is almalinux/postgresql18-pgvector. Apply the security update referenced by ALSA-2026:88360.

Published Oct 22, 2026

Updated

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance

Security Fix(es):

pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/postgresql18-pgvector<0.8.7-1.el10_2

0.8.7-1.el10_2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/postgresql18-pgvector to a version that resolves this vulnerability.
Fixed in 0.8.7-1.el10_2

Event History

Oct 22, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-103484

Frequently Asked Questions

When is this issue likely to be exploitable?

The flaw occurs during IVFFlat index build operations in pgvector. Systems that build IVFFlat indexes are the relevant exposure surface described by the advisory.

What is the potential impact of successful exploitation?

Successful exploitation can result in arbitrary code execution through an out-of-bounds write during an IVFFlat index build.

Which package should be updated?

The affected software identified by the advisory is almalinux/postgresql18-pgvector. Apply the security update referenced by ALSA-2026:88360.

ALSA-2026:88360: Important: postgresql18-pgvector security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

When is this issue likely to be exploitable?

What is the potential impact of successful exploitation?

Which package should be updated?

Company

Resources

Contact

Frequently Asked Questions

When is this issue likely to be exploitable?

What is the potential impact of successful exploitation?

Which package should be updated?