Buffer Overflow Vulnerability in HNSW Index of nmslib and Spotify Voyager

CVE-2026-124959

What is CVE-2026-124959?

The loadIndex function in both nmslib hnswlib and Spotify Voyager is vulnerable to a buffer overflow due to inadequate validation of the element count in a serialized HNSW index. If an attacker crafts an index file with an element count exceeding the allocated capacity, it can lead to heap buffer overflows. This vulnerability may cause the application to crash when attempting to load the malicious file and potentially exposes the system to further attacks.

References