{"id":"CVE-2026-124959","kind":"vulnerability","aliases":["CVE-2026-124959"],"related":[],"title":"hnswlib and Voyager: crafted index file overflows heap buffer on load","description":"The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.","summary":"The loadIndex function in nmslib hnswlib and Spotify Voyager does not check the element count in a serialized HNSW index against the stored capacity. A crafted index file can make the loader write past its heap buffer, which may crash the application that loads it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hnswlib","node","package","python","vector-search","voyager"],"not_affected_if":["trusted-index-files-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","triaged_at":"2026-11-09T15:28:13+00:00","updated_at":"2026-11-09T15:28:13+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-09T15:28:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"hnswlib and Voyager: crafted index file overflows heap buffer on load","impact":"medium","summary":"The loadIndex function in nmslib hnswlib and Spotify Voyager does not check the element count in a serialized HNSW index against the stored capacity. A crafted index file can make the loader write past its heap buffer, which may crash the application that loads it.","audience":"developers","category":"package","nicknames":[],"who_cares":["hnswlib","voyager","python","node","vector-search"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Application crashes, possibly memory corruption when loading index","analyst_note":"Check NVD entry and the hnswlib and Voyager repositories for affected version ranges and a fixed release; sources give none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-index-files-only"],"who_is_affected":"Applications that load HNSW index files with hnswlib or Voyager from untrusted or externally supplied sources are the exposed ones. Services that only load indexes they built themselves from trusted data are less exposed. unknown whether any specific version ranges are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4571,"output_tokens":472,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124959':14A,17A '-2026':13A,16A 'alloc':98C,126C 'applic':67B,132C 'attack':103C 'beyond':124C 'buffer':9A,62B,101C,127C 'capac':49B,95C,118C 'caus':119C 'check':37B 'count':40B,85C,113C 'craft':4A,51B,107C 'crash':65B,130C 'cve':12A,15A 'element':39B,84C,112C 'file':6A,53B,109C,137C 'function':28B,72C 'greater':114C 'heap':8A,61B,100C 'hnsw':44B,89C 'hnswlib':1A,18B,31B,75C 'index':5A,45B,52B,90C,108C 'load':11A,69B,135C 'loader':57B,121C 'loadindex':27B,71C 'make':55B 'may':64B 'nmslib':30B,74C 'node':19B 'overflow':7A 'packag':20B 'past':59B 'potenti':129C 'python':21B 'search':24B 'serial':43B,88C 'spotifi':33B,77C 'store':48B,94C,117C 'suppli':105C 'use':96C 'vector':23B 'vector-search':22B 'verifi':81C 'voyag':3A,25B,34B,78C 'within':92C 'write':58B,123C","nicknames":[],"mitigations":[],"who_affected":"Applications that load HNSW index files with hnswlib or Voyager from untrusted or externally supplied sources are the exposed ones. Services that only load indexes they built themselves from trusted data are less exposed. unknown whether any specific version ranges are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hnswlib","node","package","python","unknown","vectorsearch","voyager"],"campaign_type":null,"search_a":"'-124959':14A,17A '-2026':13A,16A 'buffer':9A 'craft':4A 'cve':12A,15A 'file':6A 'heap':8A 'hnswlib':1A 'index':5A 'load':11A 'overflow':7A 'voyag':3A","search_b":"'applic':67B 'buffer':62B 'capac':49B 'check':37B 'count':40B 'craft':51B 'crash':65B 'element':39B 'file':53B 'function':28B 'heap':61B 'hnsw':44B 'hnswlib':18B,31B 'index':45B,52B 'load':69B 'loader':57B 'loadindex':27B 'make':55B 'may':64B 'nmslib':30B 'node':19B 'packag':20B 'past':59B 'python':21B 'search':24B 'serial':43B 'spotifi':33B 'store':48B 'vector':23B 'vector-search':22B 'voyag':25B,34B 'write':58B","search_c":"'alloc':98C,126C 'applic':132C 'attack':103C 'beyond':124C 'buffer':101C,127C 'capac':95C,118C 'caus':119C 'count':85C,113C 'craft':107C 'crash':130C 'element':84C,112C 'file':109C,137C 'function':72C 'greater':114C 'heap':100C 'hnsw':89C 'hnswlib':75C 'index':90C,108C 'load':135C 'loader':121C 'loadindex':71C 'nmslib':74C 'potenti':129C 'serial':88C 'spotifi':77C 'store':94C,117C 'suppli':105C 'use':96C 'verifi':81C 'voyag':78C 'within':92C 'write':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T15:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124959","severity":null,"published_at":"2026-11-09T15:17:19+00:00","modified_at":"2026-11-09T15:17:19+00:00","first_seen_at":"2026-11-09T15:27:06+00:00","fetched_at":"2026-11-09T15:27:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}