CVE-2026-124959

HighCVSS 7.1/10Last modified Nov 12, 2026

Description

The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-124968.7Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS an CVE-2026-1249656.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, Bud CVE-2026-1249697.1The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary CVE-2026-124977.5The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 CVE-2026-1249709.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-bookin CVE-2026-1249876.3A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. S CVE-2026-1249923.3A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the CVE-2026-1249935.3An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-CVE-2026-1249946.3A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file e CVE-2026-1249966.3A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the f CVE-2026-1249996.3A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file CVE-2026-12507.5The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter