Quick answers
- Is CVE-2026-124959 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-124959 being exploited in the wild.
- How severe is CVE-2026-124959?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- nmslib hnswlib; Spotify Voyager.
- Is there a fix for CVE-2026-124959?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-124959 attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected by CVE-2026-124959?
- Check whether you run Nmslib Hnswlib or Spotify Voyager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The loadIndex function in both hnswlib and Voyager fails to validate that the element count in a serialized HNSW index does not exceed the stored capacity, resulting in a heap buffer overflow. An attacker can supply a malicious index file with an inflated element count to trigger out-of-bounds writes. The vulnerability requires an attacker to provide a crafted index file and the application to load it, but no authentication or special privileges are needed.
Affected products
- nmslib hnswlib
- Spotify Voyager
Timeline
- 2026-11-09: disclosed