Live › vulnerability › CVE-2026-111959
The Apache Arrow Rust library (the arrow crate) does not validate RunEndEncoded arrays in its ArrayData interface, so reads can go past the end of the child values array. An attacker who can supply crafted array data may read memory beyond the intended bounds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Applications that use the Rust arrow crate from 33.0.0 through the affected 57, 58, 59 and 60.0.0 releases, especially those that parse Arrow data from untrusted sources. Projects that only use Arrow internally with trusted data are lower risk.
No product ranges from the sources yet.
arrow crate version in Cargo.lock or with cargo tree -i arrowarrow 60.x: move to 60.1.0arrow 59.x: move to 59.3.2arrow 58.x: move to 58.4.1arrow 57.x: move to 57.3.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.