# CVE-2026-116489: Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes

> CVE-2026-116489: Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-116489
Last updated: 2026-10-26T18:39:42Z

- Published: 2026-10-26 14:59 UTC · Updated: 2026-10-26 18:39 UTC · Assigner: VulnCheck
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.50%, 43th percentile (scored 2026-11-04)
- CISA KEV: no
- CWE: CWE-843

## Description

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.

## Affected vendors and products

- timescale: pgvectorscale

## Tracked companies

- [Timescale (Tiger Data)](https://rewindex.com/company/timescale-tiger-data.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-116489)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-116489)
- [https://github.com/timescale/pgvectorscale](https://github.com/timescale/pgvectorscale)
- [https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access\_method/build.rs\#L253](https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253)
- [https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access\_method/mod.rs\#L208-L231](https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231)
- [https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access\_method/pg\_vector.rs\#L133-L151](https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151)
- [https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81](https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81)
- [https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa](https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa)
- [https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd](https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd)
- [https://github.com/timescale/pgvectorscale/pull/280](https://github.com/timescale/pgvectorscale/pull/280)
- [https://github.com/timescale/pgvectorscale/releases/tag/0.9.1](https://github.com/timescale/pgvectorscale/releases/tag/0.9.1)
- [https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes](https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-116489 · Markdown: https://rewindex.com/cve/CVE-2026-116489.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-116489 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T16:33:18.866Z