Search

Find a vulnerability

Search criteria

    1 vulnerability found for Voyager by Spotify

    CVE-2026-124959 (GCVE-0-2026-124959)

    Vulnerability from cvelistv5 – Published: 2026-11-09 15:04 – Updated: 2026-11-09 15:04
    VLAI
    Title
    Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
    Summary
    The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.
    Severity
    No CVSS data available.
    CWE
    Assigner
    certcc CNA
    References
    Impacted products
    Vendor Product Version
    Spotify Voyager Affected: 2.0.7 , ≤ 2.1.1 (custom)
    		Create a notification for this product.
    hnswlib hnswlib Affected: 0.5.0 , ≤ 0.9.0 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Voyager",
          "vendor": "Spotify",
          "versions": [
            {
              "lessThanOrEqual": "2.1.1",
              "status": "affected",
              "version": "2.0.7",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "hnswlib",
          "vendor": "hnswlib",
          "versions": [
            {
              "lessThanOrEqual": "0.9.0",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T15:04:38.649Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity"
        },
        {
          "url": "https://github.com/nmslib/hnswlib"
        },
        {
          "url": "https://github.com/spotify/voyager"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write",
      "x_generator": {
        "engine": "VINCE 4.0.2",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-124959"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-124959",
    "datePublished": "2026-11-09T15:04:38.649Z",
    "dateReserved": "2026-11-09T15:02:37.082Z",
    "dateUpdated": "2026-11-09T15:04:38.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}