---
id: "CVE-2026-111959"
kind: "vulnerability"
aliases: ["CVE-2026-111959"]
title: "Apache Arrow Rust: out-of-bounds read from malformed RunEndEncoded arrays"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["arrow", "cargo", "package", "rust"]
not_affected_if: ["arrow-not-in-use", "trusted-data-only"]
published_at: "2026-11-02T14:17:35+00:00"
first_seen_at: "2026-11-02T14:23:23+00:00"
updated_at: "2026-11-02T14:24:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111959", "first_seen_at": "2026-11-02T14:23:23+00:00"}]
---

# Apache Arrow Rust: out-of-bounds read from malformed RunEndEncoded arrays

The Apache Arrow Rust library (the arrow crate) does not validate RunEndEncoded arrays in its ArrayData interface, so reads can go past the end of the child values array. An attacker who can supply crafted array data may read memory beyond the intended bounds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the `arrow` crate version in Cargo.lock or with `cargo tree -i arrow`
- Confirm whether the application processes untrusted Arrow data with RunEndEncoded arrays

## Fix

- `arrow` 60.x: move to `60.1.0`
- `arrow` 59.x: move to `59.3.2`
- `arrow` 58.x: move to `58.4.1`
- `arrow` 57.x: move to `57.3.2`

## Timeline

- 2026-11-02T14:23:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111959

## From the sources

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.



Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.



Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_