pgvector Buffer Overflow Vulnerability in HNSW Index Build Allowing Data Leakage or Server Crash

A buffer overflow vulnerability has been identified in pgvector versions 0.6.0 through 0.8.1. This issue arises during the parallel construction of HNSW indexes, where integer wraparound can be exploited. A database user with the ability to create or reindex an HNSW index using parallel workers could potentially leak sensitive data from other relations or crash the database server.

Impact

Exploitation of this vulnerability can lead to a buffer overflow, allowing for the leakage of sensitive data from other relations or causing a crash of the database server.

Remediation

Users running an affected version should upgrade to pgvector version 0.8.2 or later.