Paper/Archive/CVE-2026-111959

CVE-2026-111959

Apache Software Foundation Apache Arrow Rust — Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 46.5.465 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Arrow Rust60.0.0 – < 60.1.060.1.0CNA

Apache Arrow Rust59.0.0 – 59.3.1–CNA

Apache Arrow Rust58.0.0 – 58.4.0–CNA

Apache Arrow Rust33.0.0 – 57.3.1–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4 refopenwall.com/lists/oss-security/2026/11/02/2