{"id":"CVE-2026-111959","kind":"vulnerability","aliases":["CVE-2026-111959"],"related":[],"title":"Apache Arrow Rust: out-of-bounds read from malformed RunEndEncoded arrays","description":"Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.","summary":"The Apache Arrow Rust library (the arrow crate) does not validate RunEndEncoded arrays in its ArrayData interface, so reads can go past the end of the child values array. An attacker who can supply crafted array data may read memory beyond the intended bounds.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arrow","cargo","package","rust"],"not_affected_if":["arrow-not-in-use","trusted-data-only"],"how_to_check":"- Check the `arrow` crate version in Cargo.lock or with `cargo tree -i arrow`\n- Confirm whether the application processes untrusted Arrow data with RunEndEncoded arrays","fix":"- `arrow` 60.x: move to `60.1.0`\n- `arrow` 59.x: move to `59.3.2`\n- `arrow` 58.x: move to `58.4.1`\n- `arrow` 57.x: move to `57.3.2`","status":"open","published_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:59+00:00","updated_at":"2026-11-02T14:24:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T14:24:59Z","model":"claude-haiku-5-5","output":{"fix":"- `arrow` 60.x: move to `60.1.0`\n- `arrow` 59.x: move to `59.3.2`\n- `arrow` 58.x: move to `58.4.1`\n- `arrow` 57.x: move to `57.3.2`","reach":"unknown","title":"Apache Arrow Rust: out-of-bounds read from malformed RunEndEncoded arrays","impact":"low","summary":"The Apache Arrow Rust library (the arrow crate) does not validate RunEndEncoded arrays in its ArrayData interface, so reads can go past the end of the child values array. An attacker who can supply crafted array data may read memory beyond the intended bounds.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","arrow","cargo"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"out-of-bounds memory read in processing code","analyst_note":"","how_to_check":"- Check the `arrow` crate version in Cargo.lock or with `cargo tree -i arrow`\n- Confirm whether the application processes untrusted Arrow data with RunEndEncoded arrays","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-data-only","arrow-not-in-use"],"who_is_affected":"Applications that use the Rust arrow crate from 33.0.0 through the affected 57, 58, 59 and 60.0.0 releases, especially those that parse Arrow data from untrusted sources. Projects that only use Arrow internally with trusted data are lower risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000714,"input_tokens":4201,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111959':15A,18A '-2026':14A,17A '33.0.0':81C '57.3.1':85C '57.3.2':121C '58.4.0':86C '58.4.1':120C '59.3.1':87C '59.3.2':119C '60.0.0':89C '60.1.0':118C 'allow':100C 'apach':1A,24B,74C 'array':12A,35B,51B,58B,94C,110C 'arraydata':38B,97C 'arrow':2A,19B,25B,29B,75C,77C 'attack':53B 'beyond':63B,103C 'bound':7A,66B,70C,105C 'cargo':20B 'child':49B,108C 'craft':57B 'crate':30B,78C 'cve':13A,16A 'data':59B,102C 'end':46B 'fix':123C 'go':43B 'improp':90C 'intend':65B 'interfac':39B,98C 'issu':125C 'librari':27B 'malform':10A 'may':60B 'memori':62B 'out-of-bound':4A,67C 'packag':21B 'past':44B 'read':8A,41B,61B,71C,101C 'recommend':113C 'runendencod':11A,34B,93C 'rust':3A,22B,26B,76C 'suppli':56B 'upgrad':115C 'user':111C 'valid':33B,91C 'valu':50B,109C 'version':80C,84C,117C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Rust arrow crate from 33.0.0 through the affected 57, 58, 59 and 60.0.0 releases, especially those that parse Arrow data from untrusted sources. Projects that only use Arrow internally with trusted data are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["arrow","cargo","low","package","rust"],"first_public_at":"2026-11-02T14:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111959","severity":null,"published_at":"2026-11-02T14:17:35+00:00","modified_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}