CVE-2026-124959 Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124959?
CVE-2026-124959 is a high-severity vulnerability in Spotify Voyager, published on 9 Nov 2026.
Official description
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
Weakness: CWE-787
Which versions are affected by CVE-2026-124959?
How do I fix CVE-2026-124959?
No fix has been published for CVE-2026-124959 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124959 being exploited?
There is no known exploitation of CVE-2026-124959 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-124959, GHSA-pvwj-4565-gq34, UBUNTU-CVE-2026-124959.