CVE-2026-61486 describes a stack-based buffer overflow vulnerability affecting all versions of Apache Lucy, an open-source full-text search library. The project has been officially retired and the maintainer has confirmed no patch will be released. Users are advised to migrate to an alternative solution or restrict access to trusted users only. This vulnerability affects an unsupported product, meaning no official remediation is forthcoming. The risk remains for any organization still running Apache Lucy in their environment. The advisory was published via NVD and the Apache mailing list.