CVE-2026-111959
Received Received - Intake

Out-of-bounds Read in Apache Arrow Rust

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Apache Software Foundation

Description
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-111959

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in Apache Arrow Rust affecting versions 33.0.0 through 60.0.0. It occurs due to improper validation of RunEndEncoded arrays in the ArrayData interface, allowing reading data beyond the bounds of the child values array.

Detection Guidance

Detection involves checking the version of the Apache Arrow Rust crate in use. Commands like 'cargo tree' or 'cargo list' can help identify installed versions. If the version is between 33.0.0 and 60.0.0, the system is potentially vulnerable.

Impact Analysis

An attacker could exploit this to read sensitive memory data, potentially leading to information disclosure or crashes. Systems processing untrusted data with affected versions are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical implementation flaw in Apache Arrow Rust. However, it could indirectly impact compliance if exploited to access unauthorized data, potentially violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade to the patched versions: 60.1.0, 59.3.2, 58.4.1, or 57.3.2. Use commands like 'cargo update -p arrow' to update the crate. Verify the update with 'cargo tree' to confirm the correct version is installed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...