CVE-2026-124959
Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
Exploit likelihood
What each source reports
CVE List No score
Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
CVE-2026-124959- Updated
- 2026-11-09
EUVDEUVD-2026-120081 No score
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
EUVD-2026-120081- Updated
- 2026-11-09
GitHub AdvisoriesGHSA-pvwj-4565-gq34 No score
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element...
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
GHSA-pvwj-4565-gq34- Updated
- 2026-11-09
NVD No score
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
CVE-2026-124959- Updated
- 2026-11-09
OSV No score
Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
CVE-2026-124959- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-124959 No score
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
- Record
DEBIAN-CVE-2026-124959- Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hnswlibDebian:12 |
All versions, plus listed versions 0.6.2-20.6.2-2+deb12u10.7.0-10.7.0-20.8.0-10.9.0-10.9.0-2 |
None known |
hnswlibDebian:13 |
All versions, plus listed versions 0.8.0-10.9.0-10.9.0-2 |
None known |
hnswlibDebian:14 |
All versions, plus listed versions 0.8.0-10.9.0-10.9.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| references | OSV | |
| published | EUVD, NVD | |
| published | EUVD | |
| products, title | CVE List | |
| aliases, products, published, references | EUVD | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-124959 is a vulnerability with no CVSS score yet in Devdojo Voyager, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
References
m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity
github.com/nmslib/hnswlib
nvd.nist.gov/vuln/detail/CVE-2026-124959
security-tracker.debian.org/tracker/CVE-2026-124959