repository icon
facebookresearch / faiss Project repository

A library for efficient similarity search and clustering of dense vectors.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN14 DAYS

FIX

WITHINN/A DAYS

Insecure Deserialization in faiss.contrib.rpc allows Remote Arbitrary File Read/...
notfound-sec
duplicate
Critical
Arbitrary Code Execution via Insecure Deserialization in BigBatchSearcher.read_c...
mikeappsec
self closed
Code injection via eval() on config-driven metric value and CLI command in offli...
snakeyworm
duplicate
High
Arbitrary local file read in faiss::read_index() via trusted OnDiskInvertedLists...
jasanpes
pending
Code injection via eval() on config-driven metric value and CLI command in offli...
wormysnake
duplicate
High
Off-by-one Out-of-bounds Read in HNSW::neighbor_range during Similarity Search
thejasrajamoney
pending
High-Impact Out-of-bounds Write in hnsw_add_vertices via Negative Array Index (...
thejasrajamoney
pending
Critical Heap-based Buffer Overflow in ArrayInvertedLists::add_entries
thejasrajamoney
duplicate
High
Stack Overflow via Unbounded Recursive Index Deserialization in read_index()
caoxuyang
pending
[faiss] Insecure deserialization of OnDiskInvertedLists enables arbitrary local...
misakim1
pending
Arbitrary file read and write via OnDiskInvertedLists path in crafted index file
k-rintaro
duplicate
High
Integer Overflow in ilpn Deserialization — Missing mul_no_overflow() causes DoS...
mscgo
self closed
Arbitrary File Read via OnDiskInvertedLists — malicious .index opens any file vi...
mscgo
self closed
World-writable permissions (chmod 777) on shared data directory in CI workflows
nhomyk
pending
RCE via eval() on CLI command argument and config metric value
nhomyk
duplicate
High
RCE via pickle.load() and torch.load(weights_only=False) in benchmark and demo m...
nhomyk
pending
Uncontrolled Recursion in faiss::read_index Allows Denial of Service via Crafted...
yerang30
pending
Path traversal via OnDiskInvertedLists filename in read_index allows arbitrary f...
eistee82
self closed
Path traversal via OnDiskInvertedLists filename in read_index allows arbitrary f...
eistee82
self closed
Unsafe pickle.load() in faiss big_batch_search() Checkpoint Enables RCE via Mali...
odysseypro25-project
self closed
Heap Buffer Overflow via Unvalidated HadamardRotation Dimensions in Index Deseri...
pucagit
pending
Arbitrary code execution via eval() injection in FAISS offline IVF configuration...
elucidator-hky
self closed
Arbitrary code execution via unsafe pickle.load and torch.load(weights_only=Fals...
elucidator-hky
self closed
NNDescent Heap Out-of-Bounds Read/Write via Unvalidated Graph Node IDs in Deseri...
appsecguardian-hash
pending
Arbitrary File Read/Write via OnDiskInvertedLists Path Traversal
appsecguardian-hash
pending
Unbounded n_levels in ilpn deserialization causes disproportionate heap allocati...
nexussss7
pending
Arbitrary File Read/Truncation via OnDiskInvertedLists Path Traversal
alrightryanx
self closed
HadamardRotation deserialization OOB write
realsung
pending
Unsafe deserialization via pickle in FAISS index loading
etwithin
pending
Missing Validation of ScalarQuantizer.d During Deserialization Leads to OOB Read...
hiyokosauna37
duplicate
High
Code Injection via `eval()` on `--command` Argument in `demos/offline_ivf/run.py...
b-hermes
pending
Heap-Based Buffer Overflow in Faiss IndexPreTransform Deserialization
finder16
duplicate
High
Integer Overflow in ArrayInvertedListsPanorama Deserialization Leading to Heap O...
p0her
duplicate
Medium
Out-of-Bounds Read and Write via Malicious NNDescent Index in Faiss
zitoxxx
pending
Arbitrary File Read/Write via OnDiskInvertedLists Deserialized Filename
wernerina
duplicate
High
IndexIDMap2 NULL Pointer Dereference in construct_rev_map() During Deserializati...
morecitricacid-coder
pending
IndexIDMap NULL Pointer Read in search_ex() via Crafted Index
morecitricacid-coder
pending
IndexRaBitQ NULL Pointer Read in distance_to_code_1bit() via Crafted Index
morecitricacid-coder
pending
IndexHNSW NULL Pointer Read in VisitedTable::set() via Crafted Index
morecitricacid-coder
pending
AdditiveQuantizer NULL Pointer Read in set_derived_values() During Deserializati...
morecitricacid-coder
pending
IndexPQ NULL Pointer Read in PQDecoderGeneric::decode() via Crafted Index
morecitricacid-coder
pending
IndexLSH NULL Pointer Read in apply_preprocess via Crafted Index
morecitricacid-coder
pending
IndexFlat NULL Pointer Write via Crafted Index in compute_residual Path
morecitricacid-coder
pending
Out-of-bounds Heap Read in ScalarQuantizer Codec8bit via Crafted FAISS Index
morecitricacid-coder
duplicate
None
Out-of-bounds Heap Read in ScalarQuantizer Codec8bit via Crafted FAISS Index
morecitricacid-coder
duplicate
None
FAISS ScalarQuantizer Codec6bit Out-of-Bounds Heap Read via Crafted Index
morecitricacid-coder
duplicate
High
Arbitrary File Read via Path Traversal in OnDiskInvertedLists
alrightryanx
duplicate
Medium
Heap Buffer Overflow via Crafted NNDescent Index
alrightryanx
duplicate
High
Out-of-bounds Heap Read in ScalarQuantizer Codecs via Crafted FAISS Index File
morecitricacid-coder
duplicate
None
Out-of-bounds Heap Read in ScalarQuantizer Codecs via Crafted FAISS Index File
morecitricacid-coder
self closed
Out-of-bounds Heap Read in ScalarQuantizer Codecs via Crafted FAISS Index File
morecitricacid-coder
self closed
ArrayInvertedLists Sparse idsizes Out-of-Bounds Heap Read via Odd-Length Vector
iiviel
duplicate
High
Heap-buffer-overflow in ScalarQuantizer decode via crafted .faiss index file
cr-itamarhershko
duplicate
Medium
READVECTOR macro allows 8TB memory allocation DoS via crafted .faissindex file —...
iiviel
pending
Out-of-Bounds Heap Read via odd-length sparse idsizes vector in ArrayInvertedLis...
iiviel
duplicate
High
Integer overflow in NSG graph deserialization leads to heap buffer overflow writ...
iiviel
duplicate
Critical
Arbitrary Code Execution via ```pickle.load()``` on Attacker-Supplied Checkpoin...
abdallaabdalrhman
duplicate
High
RPC Server Sends Unrestricted Pickle — Attacker-Controlled Server Achieves RCE o...
abdallaabdalrhman
duplicate
Critical
Integer Overflow in BinaryHash Bitstring Buffer Allocation
abdallaabdalrhman
pending
FAISS IndexBinaryHash BitstringReader Out-of-bounds Read Vulnerability
mia-718ai
duplicate
High
Integer Overflow in Panorama IVF Leads to Heap Buffer Overflow
abdallaabdalrhman
pending
Arbitrary File Read via Path Traversal in ```OnDiskInvertedLists``` Filename Des...
abdallaabdalrhman
pending
Heap Out-of-Bounds Write via Crafted NSG Index — Arbitrary Code Execution Path
abdallaabdalrhman
duplicate
Critical
Out-of-Bounds Heap Read in read_ArrayInvertedLists_sizes() via Odd-Length Sparse...
abdallaabdalrhman
duplicate
High
FAISS Benchmark Framework Unsafe Pickle Deserialization leads to Remote Code Exe...
mia-718ai
duplicate
High
FAISS index_factory std::stoi Exception Handling - Denial of Service
mia-718ai
pending
FAISS rev_swig_ptr() Use-After-Free Due to Unsafe numpy Array Creation from C++...
mia-718ai
pending
FAISS IndexIVFFlatDedup Deserialization Heap Buffer Over-read Vulnerability
mia-718ai
pending
Heap-Based Buffer Overflow in faiss::imbalance_factor() Leading to Remote Denial...
ahmtbrt07
duplicate
Critical
Unvalidated `n_levels` allows division-by-zero crash in Panorama-based indexes
f00dat
duplicate
High
Heap Buffer Overflow in FAISS IVF via imbalance_factor()
hyperps
pending
FAISS Python API: Externally-Controlled Format String leads to DOS
prodigysec
pending
Faiss NSG Deserialization OOB Write
somet2mes
duplicate
High
Parallel exception masking in OpenMP loops hides failures (CWE-703)
happyjesterr
self closed
Null pointer dereference in GenericDistanceComputer::operator() causes process c...
happyjesterr
self closed
Unmanaged raw pointer allocations may leak memory on exception paths in Faiss (r...
happyjesterr
self closed
Denial of Service via unbounded pickle deserialization in FAISS RPC ( contrib/rp...
0init
duplicate
Medium
Client-side RCE via Unsafe Pickle Deserialization in FAISS contrib/rpc.py (Res...
0init
duplicate
High
Integer Overflow in FAISS IndexBinary::search_and_reconstruct Leading to Memory...
elexs1zz
duplicate
High
Integer Overflow in Binary Search Midpoint Calculation Leading to Out-of-Bounds...
joelindra
pending
Faiss C API: Heap Buffer Overflow in IndexIVF (invlists_get_ids)
thevilledev
pending
Faiss C API: Uninitialized Memory in faiss_Index_sa_code_size Leading to Potenti...
thevilledev
pending
Bypass of RestrictedUnpickler in RPC Module Leads to Remote Code Execution
shenaow
informative
Critical
Buffer Overflow
azqzazq1
informative
High
Insecure Temporary File
h2oa
not applicable
Malicious file loaded to RCE in big_batch_search
supersuperbang
informative
High
Floating Point Exception in index_factory
r3pwnx
pending
huntr: facebookresearch/faiss