CVE-2026-124959

Name of the Vulnerable Software and Affected Versions mslib (affected versions not specified) hnswlib (affected versions not specified) Spotify Voyager (affected versions not specified)

Description The loadIndex() function fails to verify if the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can provide a crafted index file where the element count exceeds the stored capacity, leading to a heap buffer overflow. This occurs because the loader writes data beyond the allocated buffer, which can result in an application crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.