Apache Arrow Rust CVE-2026-111959

Requires an application built on the arrow crate (any version from 33.0.0 up to and including 57.3.1, 58.4.0, 59.3.1, or 60.0.0) to construct an ArrayData for a RunEndEncoded array where the run-end values are attacker-influenced or malformed; the missing bounds validation then permits reads past the end of the child values array. The principal limiting factor is that this is a library-internal flaw: it is only reachable when untrusted or malformed RunEndEncoded array data flows into the ArrayData interface, so applications that process only trusted, internally generated Arrow data are not realistically exposed. No special product configuration setting is named in the advisory; exposure is a function of the data trust boundary around the crate.

No CVSS score or vector is provided by any source, so severity must be inferred from the weakness class and advisory text rather than a scored vector. This is a CWE-125 out-of-bounds read whose practical impact is information disclosure (reading memory beyond the child values array) and possibly a process crash - it does not permit writing, code execution, or integrity compromise per the description. Exploitation requires an application built on the vulnerable arrow crate to process an attacker-influenced or malformed RunEndEncoded array through the ArrayData interface, so it is a library-level flaw whose real exposure depends entirely on whether untrusted Arrow data reaches that code path. On the exploitation signals: there is no CISA KEV listing, no EPSS probability supplied, and no public exploit reference - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', indicating a moderate, scheduled-patch priority rather than an emergency. Net assessment: a genuine but bounded issue - worth patching on a normal monthly cadence, weighted up for teams that feed untrusted or externally sourced Arrow buffers into the crate and down for those processing only trusted internal data. Because no CVSS vector was supplied, authentication requirements are not confirmed from available data.

An application using a vulnerable version of the Rust arrow crate ingests an Arrow buffer from an untrusted source (e.g. a file, RPC payload, or network stream) and constructs an ArrayData for a RunEndEncoded array. Because the run-ends are not properly validated, a crafted array causes the library to read past the end of the child values array, leaking adjacent process memory into results or triggering a crash. No public exploit code is identified at time of analysis, and because no CVSS vector was supplied the required access level and interaction cannot be confirmed from the data.